Text

Report to NRC of Changes of Technical Specifications Bases
	ML111160597
Person / Time
Site:	Palisades
Issue date:	04/25/2011
From:	Patricia Anderson; Entergy Nuclear Operations
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	PNP 2011-032
	Download: ML111160597 (111)
	v • d • e

Entergy Nuclear Operations, Inc.

~ Iintei 27780 Covert,Blue Star Memorial Highway Ml 49043 Tel 269 764 2000 Paula K Anderson Licensing Manager PNP 2011-032 April 25, 2011 U. S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001

SUBJECT:

Report to NRC of Changes to Technical Specifications Bases Palisades Nuclear Plant Docket 50-255 License No. DPR-20

Dear Sir or Madam:

This report is submitted in accordance with Palisades Technical Specification 5.5.12.d, which requires that changes to the Technical Specifications Bases, implemented without prior Nuclear Regulatory Commission (NRC) approval, be provided to the NRC on a frequency consistent with 10 CFR 50.71(e). Attachment 1 provides a listing of all bases changes since issuance of the previous report, dated November 2, 2009, and identifies the affected sections and describes the nature of the changes. Attachment 2 provides page change instructions, a copy of the current Technical Specifications Bases List of Effective Pages, and the revised Technical Specifications Bases sections and table listed in Attachment 1.

Summary of Commitments This letter identifies no new commitments and no revisions to existing commitments.

pkalrbh Attachment(s): 1. List of Technical Specifications Bases Changes

2. Revised Technical Specifications Bases cc: Administrator, Region Ill, USNRC Project Manager, Palisades, USNRC Resident Inspector, Palisades, USNRC

ATTACHMENT 1 LIST OF TECHNICAL SPECIFICATIONS BASES CHANGES Date Affected Bases Change Description 4/14/2011 Section B 2.1.1 The Bases are revised to reflect that high thermal performance (HTP) fuel assemblies, rather than non-HTP fuel assemblies, are now used for reactor vessel fluence reduction.

4/14/2011 Table B 3.3.1-1 Two steam generator pressure instruments are added to Table B 3.3.1-1, Instruments Affecting Multiple Specifications. These two instruments are added for clarification and completeness.

4/14/2011 Section B 3.3.5 In the reference list, two references are updated due to calculation changes related to calibration setpoint changes for second level undervoltage relays.

4/14/2011 Section B 3.4.12 The Bases are revised to provide updated reactor vessel fluence and validity date information for the pressure-temperature and low temperature overpressure curves. This information was developed in a recent pressure-temperature curve analysis.

4/14/2011 Section B 3.6.3 A paragraph in the Bases is clarified to state that, for analyzed accidents not discussed earlier in the paragraph, a primary coolant system release path to the secondary side of a steam generator would require a passive failure, which is outside of the site licensing basis.

4/14/2011 Section B 3.7.6 An editorial correction is made by removing an extraneous word (an) from page B 3.7.6-1.

4/14/2011 Section B 3.7.9 A discussion in the Bases concerning service water system heat loads is editorially revised for clarity.

4/14/2011 Section B 3.7.17 The Bases are revised to delete an erroneous statement that a 0.3 gpm steam generator tube leak corresponds to the primary-to-secondary leakrate allowed by Technical Specification LCO 3.4.13. The leakrate allowed by this LCO was revised under Amendment No. 223, dated July 6, 2006, and no longer corresponds to 0.3 gpm.

Page 1 of 2

Document Control Desk Page 2 4/14/2011 Section B 3.8.1 The Bases discussion is clarified to describe the alignment of equipment when using station power transformer 1-2 to supply 2400V safety related buses and that this alignment results in the qualified offsite source to be inoperable, requiring entry into the Action statement of LCO 3.8.1.

Page 2 of 2

ATTACHMENT 2 REVISED TECHNICAL SPECIFICATIONS BASES Page Change Instructions List of Effective Pages Technical Specification Bases Section B 2.1.1 Table B 3.3.1-1 Section B 3.3.5 Section B 3.4 12 Section B 3.6.3 Section B 3.7.6 Section B 3.7.9 Section B 3.7.17 Section B 3.8.1 107 Pages Follow

PALISADES PLANT Technical Specifications Bases April 14, 2011 Revise your copy of the Palisades Technical Specifications Bases by removing the pages identified below and inserting the revised pages. The revised pages are identified by revision date at the bottom of the page. Vertical lines in the margin indicate the area of change.

LIST of EFFECTIVE PAGES and T.S. BASES Remove Insert

Palisades Tech Spec Bases

Palisades Tech Spec Bases List of Effective Pages, List of Effective Pages, Revised 10/29/2009 (2 pages) Revised 04/14/2011 (2 pages)

Pages B 2.1.1 B 2.1.1-4,

Pages B 2.1.1 B 2.1.1-4, Revised 9/28/01 (4 pages) Revised 4/14/11 (4 pages)

Pages B 3.3.1 B 3.3.1-35,

Pages B 3.3.1 B 3.3.1-35, Revised 10/29/09 (35 pages) Revised 4/14/11 (35 pages)

Pages B 3.3.5 B 3.3.5-6,

Pages B 3.3.5 B 3.3.5-6, Revised 01/26/04 (6 pages) Revised 04/14/11 (6 pages)

Pages B 3.4.12 B 3.4.12-13,

Pages B 3.4.12 B 3.4.12-13, Revised 10/29/09 (13 pages) Revised 04/14/11 (13 pages)

Pages B 3.6.3 B 3.6.3-12,

Pages B 3.6.3 B 3.6.3-12, Revised 03/02/04 (12 pages) Revised 04/14/11 (12 pages)

Pages B 3.7.6 B 3.7.6-4,

Pages B 3.7.6 B 3.7.6-4, Revised 07/31/07 (4 pages) Revised 04/14/11 (4 pages)

Pages B 3.7.9 B 3.7.9-3,

Pages B 3.7.9 B 3.7.9-3, Revised 07/16/01 (3 pages) Revised 04/14/11 (3 pages)

Pages B 3.7.17 B 3.7.17-3,

Pages B 3.7.17 B 3.7.17-3, Revised 07/22/02 (3 pages) Revised 04/14/11 (3 pages)

Pages B 3.8.1 B 3.8.1-24,

Pages B 3.8.1 B 3.8.1-24, Revised 02/24/05 (24 pages) Revised 04/14/11 (24 pages)

Page 1 of 1

PALISADES TECHNICAL SPECIFICATIONS BASES 1 LIST OF EFFECTIVE PAGES COVERSHEET Title Page 236 - Revised 02/19/09 TABLE OF CONTENTS Pages i and ii Revised 02/19/09 TECHNICAL SPECIFICATIONS BASES Bases 2.0 Pages B 2.1.1 B 2.1.1-4 Revised 04/14/11 Pages B 2.1.2 B 2.1.2-4 189 Bases 3.0 Pages B 3.0 B 3.0-16 Revised 02/24/05 Bases 3.1 Pages B 3.1.1 B 3.1.1-5 189 Pages B 3.1.2 B 3.1.2-6 Revised 09/09/03 Pages B 3.1.3 B 3.1.3-4 189 Pages B 3.1.4 B 3.1.4-13 Revised 07/18/07 Pages B 3.1.5 B 3.1.5-7 Revised 07/02/04 Pages B 3.1.6 B 3.1.6-9 Revised 07/30/03 Pages B 3.1.7 B 3.1.7-6 Revised 05/15/07 Bases 3.2 Pages B 3.2.1 B 3.2.1-11 Revised 08/06/04 Pages B 3.2.2 B 3.2.2-3 Revised 09/28/01 Pages B 3.2.3 B 3.2.3-3 Revised 09/28/01 Pages B 3.2.4 B 3.2.4-3 189 - Revised 08/09/00 Bases 3.3 Pages B 3.3.1 B 3.3.1-35 Revised 04/14/11 Pages B 3.3.2 B 3.3.2-10 189 - Revised 02/12/01 Pages B 3.3.3 B 3.3.3-24 Revised 03/20/08 Pages B 3.3.4 B 3.3.4-12 Revised 09/09/03 Pages B 3.3.5 B 3.3.5-6 Revised 04/14/11 Pages B 3.3.6 B 3.3.6-6 189 - Revised 02/12/01 Pages B 3.3.7 B 3.3.7-12 Revised 04/19/05 Pages B 3.3.8 B 3.3.8-6 Revised 02/24/05 Pages B 3.3.9 B 3.3.9-5 189 - Revised 08/09/00 Pages B 3.3.10 B 3.3.10-4 189 Bases 3.4 Pages B 3.4.1 B 3.4.1-4 Revised 08/24/04 Pages B 3.4.2 B 3.4.2-2 189 Pages B 3.4.3 B 3.4.3-7 Revised 01/27/05 Pages B 3.4.4 B 3.4.4-4 Revised 09/21/06 Pages B 3.4.5 B 3.4.5-5 Revised 09/21/06 Pages B 3.4.6 B 3.4.6-6 Revised 07/31/07 Pages B 3.4.7 B 3.4.7-7 Revised 07/31/07 Pages B 3.4.8 B 3.4.8-5 Revised 07/31/07 Pages B 3.4.9 B 3.4.9-6 189 Pages B 3.4.10 B 3.4.10-4 189 Pages B 3.4.11 B 3.4.11-7 Revised 02/24/05 Pages B 3.4.12 B 3.4.12-13 Revised 04/14/11 Pages B 3.4.13 B 3.4.13-7 Revised 03/20/08 Pages B 3.4.14 B 3.4.14-8 189 - Revised 08/09/00 Pages B 3.4.15 B 3.4.15-6 Revised 02/24/05 Pages B 3.4.16 B 3.4.16-5 Revised 02/24/05 Pages B 3.4.17 B 3.4.17-7 223 Revised 04/14/2011

PALISADES TECHNICAL SPECIFICATIONS BASES 2 LIST OF EFFECTIVE PAGES Bases 3.5 Pages B 3.5.1 B 3.5.1-5 189 Page B 3.5.1-6 191 Page B 3.5.1-7 189 Page B 3.5.1-8 191 Pages B 3.5.2 B 3.5.2-12 228 Pages B 3.5.3 B 3.5.3-4 Revised 07/22/02 Pages B 3.5.4 B 3.5.4-7 227 Pages B 3.5.5 B 3.5.5-5 227 Bases 3.6 Pages B 3.6.1 B 3.6.1-4 Revised 12/10/02 Pages B 3.6.2 B 3.6.2-8 Revised 08/12/03 Pages B 3.6.3 B 3.6.3-12 Revised 04/14/11 Pages B 3.6.4 B 3.6.4-3 Revised 04/27/01 Pages B 3.6.5 B 3.6.5-3 Revised 09/09/03 Pages B 3.6.6 B 3.6.6-12 227 Bases 3.7 Pages B 3.7.1 B 3.7.1-4 Revised 08/06/04 Pages B 3.7.2 B 3.7.2-6 Revised 12/02/02 Pages B 3.7.3 B 3.7.3-5 Revised 12/02/02 Pages B 3.7.4 B 3.7.4-4 Revised 07/16/08 Pages B 3.7.5 B 3.7.5-9 Revised 02/24/05 Pages B 3.7.6 B 3.7.6-4 Revised 04/14/11 Pages B 3.7.7 B 3.7.7-9 Revised 06/07/05 Pages B 3.7.8 B 3.7.8-8 Revised 10/29/09 Pages B 3.7.9 B 3.7.9-3 Revised 04/14/11 Pages B 3.7.10 B 3.7.10-8 230 Pages B 3.7.11 B 3.7.11-5 189 Pages B 3.7.12 B 3.7.12-7 Revised 07/16/03 Pages B 3.7.13 B 3.7.13-3 189 - Revised 08/09/00 Pages B 3.7.14 B 3.7.14-3 Revised 09/09/03 Pages B 3.7.15 B 3.7.15-2 236 Pages B 3.7.16 B 3.7.16-4 236 Pages B 3.7.17 B 3.7.17-3 Revised 04/14/11 Bases 3.8 Pages B 3.8.1 B 3.8.1-24 Revised 04/14/11 Pages B 3.8.2 B 3.8.2-4 Revised 11/06/01 Pages B 3.8.3 B 3.8.3-7 Revised 07/22/02 Pages B 3.8.4 B 3.8.4-9 Revised 07/13/06 Pages B 3.8.5 B 3.8.5-3 Revised 11/06/01 Pages B 3.8.6 B 3.8.6-6 189 - Revised 08/09/00 Pages B 3.8.7 B 3.8.7-3 189 Pages B 3.8.8 B 3.8.8-3 Revised 11/06/01 Pages B 3.8.9 B 3.8.9-7 Revised 11/06/01 Pages B 3.8.10 B 3.8.10-3 Revised 11/06/01 Bases 3.9 Pages B 3.9.1 B 3.9.1-4 189 - Revised 08/09/00 Pages B 3.9.2 B 3.9.2-3 189 - Revised 02/12/01 Pages B 3.9.3 B 3.9.3-6 189 - Revised 08/09/00 Pages B 3.9.4 B 3.9.4-4 Revised 07/31/07 Pages B 3.9.5 B 3.9.5-4 Revised 07/31/07 Pages B 3.9.6 B 3.9.6-3 189 - Revised 02/27/01 Revised 04/14/2011

Reactor Core SLs B 2.1.1 B 2.0 SAFETY LIMITS (SLs)

B 2.1.1 Reactor Core SLs BASES BACKGROUND The Palisades Nuclear Plant design criteria (Ref. 1) requires, and these SLs ensure, that specified acceptable fuel design limits are not exceeded during steady state operation, normal operational transients, and Anticipated Operational Occurrences (AOOs). This is accomplished by having a Departure from Nucleate Boiling (DNB) design basis, which corresponds to a 95% probability at a 95% confidence level (95/95 DNB criterion) that DNB will not occur and by requiring that fuel centerline temperature stays below the melting temperature.

The restrictions of this SL prevent overheating of the fuel and cladding and possible cladding perforation that would result in the release of fission products to the primary coolant. Overheating of the fuel is prevented by maintaining the steady state, peak Linear Heat Rate (LHR) below the level at which fuel centerline melting occurs.

Overheating of the fuel cladding is prevented by restricting fuel operation to within the nucleate boiling regime, where the heat transfer coefficient is large and the cladding surface temperature is slightly above the coolant saturation temperature.

Fuel centerline melting occurs when the local LHR, or power peaking, in a region of the fuel is high enough to cause the fuel centerline temperature to reach the melting point of the fuel. Expansion of the pellet upon centerline melting may cause the pellet to stress the cladding to the point of failure, allowing an uncontrolled release of activity to the primary coolant.

Operation above the boundary of the nucleate boiling regime beyond onset of DNB could result in excessive cladding temperature because of the resultant sharp reduction in the heat transfer coefficient in the transition and film boiling regimes. If a steam film is allowed to form, high cladding temperatures are reached, and a cladding water (zirconium water) reaction may take place. This chemical reaction results in oxidation of the fuel cladding to a structurally weaker form.

This weaker form may lose its integrity, resulting in an uncontrolled release of activity to the primary coolant.

Palisades Nuclear Plant B 2.1.1-1 Revised 04/14/2011

Reactor Core SLs B 2.1.1 BASES BACKGROUND The Reactor Protective System (RPS), in combination with the LCOs, is (continued) designed to prevent any anticipated combination of transient conditions for Primary Coolant System (PCS) temperature, pressure, and THERMAL POWER level that would result in a violation of the reactor core SLs.

APPLICABLE The fuel cladding must not sustain damage as a result of normal SAFETY ANALYSES operation and AOOs. The reactor core SLs are established to preclude violation of the following fuel design criteria:

a. There must be at least a 95% probability at a 95% confidence level (95/95 DNB criterion) that the hot fuel rod in the core does not experience DNB; and

b. The hot fuel pellet in the core must not experience centerline fuel melting.

Palisades uses three DNB correlations; the XNB, ANFP, and HTP detailed in References 3 through 8. The DNB correlations are used solely as analytical tools to ensure that plant conditions will not degrade to the point where DNB could be challenged. The XNB correlation is used for non-High Thermal Performance (HTP) assemblies (assemblies loaded prior to cycle 9), when the non-HTP assemblies could have been limiting. The XNB correlation provides administrative justification for using non-HTP assemblies in Palisades low leakage core design. The ANFP and HTP correlations are used for Palisades High Thermal Performance (HTP) fuel assemblies (assemblies loaded in cycle 9 and later).

The HTP correlation can be used when the calculated reactor coolant conditions fall within the correlation's applicable coolant condition ranges. Outside of the applicable range of the HTP correlation, the ANFP correlation can be used. The ANFP correlation may be used over a broader range of coolant conditions than the HTP correlation.

The HTP correlation is an extension of the ANFP correlation and incorporates the results of test sections designed to represent HTP fuel design for CE plants.

Palisades Nuclear Plant B 2.1.1-2 Revised 04/14/2011

Reactor Core SLs B 2.1.1 BASES APPLICABLE The prediction of DNB is a function of several measured parameters.

SAFETY ANALYSES The following trip functions and LCOs, limit these measured parameters (continued) to protect the Palisades reactor from approaching conditions that could lead to DNB:

Parameter Protection Core Flow Rate Low PCS Flow Trip Core Power Variable High Power Trip PCS Pressure/Core Power TM/LP Trip Core Inlet Temperature Tinlet LCO Axial Shape Index (ASI) ASI LCO Assembly Power Incore Power Monitoring (LHR and FRT LCOs)

The RPS setpoints, LCO 3.3.1, "Reactor Protective System (RPS)

Instrumentation," in combination with all the LCOs, are designed to prevent any anticipated combination of transient conditions for PCS temperature, pressure, and THERMAL POWER level that would result in a Departure from Nucleate Boiling Ratio (DNBR) of less than the DNBR limit and preclude the existence of flow instabilities.

The SL represents a design requirement for establishing the protection system trip setpoints identified previously. LCO 3.2.1, "Linear Heat Rate (LHR)," and LCO 3.2.2, TOTAL RADIAL PEAKING FACTOR (FRT )," or the assumed initial conditions of the safety analyses (as indicated in the FSAR, Ref. 2) provide more restrictive limits to ensure that the SLs are not exceeded.

SAFETY LIMITS SL 2.1.1.1 and SL 2.1.1.2 ensure that the minimum DNBR is not less than the safety analyses limit and that fuel centerline temperature remains below melting.

The minimum value of the DNBR during normal operation and design basis AOOs is limited to the following DNB correlation safety limit:

Correlation Safety Limit XNB 1.17 ANFP 1.154 HTP 1.141 The fuel centerline melt LHR value assumed in the safety analysis is 21 kw/ft. Operation £ 21 kw/ft maintains the dynamically adjusted peak LHR and ensures that fuel centerline melt will not occur during normal operating conditions or design AOOs.

Palisades Nuclear Plant B 2.1.1-3 Revised 04/14/2011

Reactor Core SLs B 2.1.1 BASES APPLICABILITY SL 2.1.1.1 and SL 2.1.1.2 only apply in MODES 1 and 2 because these are the only MODES in which the reactor is critical. Automatic protection functions are required to be OPERABLE during MODES 1 and 2 to ensure operation within the reactor core SLs. The steam generator safety valves or automatic protection actions are available to prevent PCS heatup to the reactor core SL conditions or to initiate a reactor trip function, which forces the plant into MODE 3. Setpoints for the reactor trip functions are specified in LCO 3.3.1.

In MODES 3, 4, 5, and 6, a reactor core SL is not required, since the reactor is not generating significant THERMAL POWER.

SAFETY LIMIT The following violation responses are applicable to the reactor VIOLATIONS core SLs.

2.2.1 If SL 2.1.1.1 or SL 2.1.1.2 is violated, the requirement to go to MODE 3 places the plant in a MODE in which this SL is not applicable.

The allowed Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months recognizes the importance of bringing the plant to a MODE where this SL is not applicable and reduces the probability of fuel damage.

REFERENCES 1. FSAR, Section 5.1

2. FSAR, Chapter 14

3. XN-NF-621(A), Rev 1

4. XN-NF-709

5. ANF-1224(A), May 1989

6. ANF-89-192, January 1990

7. XN-NF-82-21, Rev 1

8. EMF-92-153(A) and Supplement 1, March 1994 Palisades Nuclear Plant B 2.1.1-4 Revised 04/14/2011

RPS Instrumentation B 3.3.1 B 3.3 INSTRUMENTATION B 3.3.1 Reactor Protective System (RPS) Instrumentation BASES BACKGROUND The RPS initiates a reactor trip to protect against violating the acceptable fuel design limits and breaching the reactor coolant pressure boundary during Anticipated Operational Occurrences (AOOs). (As defined in 10 CFR 50, Appendix A, "Anticipated operational occurrences mean those conditions of normal operation which are expected to occur one or more times during the life of the nuclear power unit and include but are not limited to loss of power to all recirculation pumps, tripping of the turbine generator set, isolation of the main condenser, and loss of all offsite power.") By tripping the reactor, the RPS also assists the Engineered Safety Features (ESF) systems in mitigating accidents.

The protection and monitoring systems have been designed to ensure safe operation of the reactor. This is achieved by specifying Limiting Safety System Settings (LSSS) in terms of parameters directly monitored by the RPS, as well as LCOs on other reactor system parameters and equipment performance.

The LSSS, defined in this Specification as the Allowable Values, in conjunction with the LCOs, establish the threshold for protective system action to prevent exceeding acceptable limits during Design Basis Accidents (DBAs).

During AOOs, which are those events expected to occur one or more times during the plant life, the acceptable limits are:

The Departure from Nucleate Boiling Ratio (DNBR) shall be maintained above the Safety Limit (SL) value to prevent departure from nucleate boiling;

Fuel centerline melting shall not occur; and

The Primary Coolant System (PCS) pressure SL of 2750 psia shall not be exceeded.

Maintaining the parameters within the above values ensures that the offsite dose will be within the 10 CFR 50 (Ref. 1) and 10 CFR 100 (Ref. 2) criteria during AOOs.

Palisades Nuclear Plant B 3.3.1-1 Revised 04/14/2011

RPS Instrumentation B 3.3.1 BASES BACKGROUND Accidents are events that are analyzed even though they are not (continued) expected to occur during the plant life. The acceptable limit during accidents is that the offsite dose shall be maintained within an acceptable fraction of 10 CFR 100 (Ref. 2) limits. Different accident categories allow a different fraction of these limits based on probability of occurrence. Meeting the acceptable dose limit for an accident category is considered having acceptable consequences for that event.

The RPS is segmented into four interconnected modules. These modules are:

Measurement channels;

RPS trip units;

Matrix Logic; and

Trip Initiation Logic.

This LCO addresses measurement channels and RPS trip units. It also addresses the automatic bypass removal feature for those trips with Zero Power Mode bypasses. The RPS Logic and Trip Initiation Logic are addressed in LCO 3.3.2, "Reactor Protective System (RPS) Logic and Trip Initiation." The role of the measurement channels, RPS trip units, and RPS Bypasses is discussed below.

Measurement Channels Measurement channels, consisting of pressure switches, field transmitters, or process sensors and associated instrumentation, provide a measurable electronic signal based upon the physical characteristics of the parameter being measured.

With the exception of Hi Startup Rate, which employs two instrument channels, and Loss of Load, which employs a single pressure sensor, four identical measurement channels with electrical and physical separation are provided for each parameter used in the direct generation of trip signals. These are designated channels A through D.

Some measurement channels provide input to more than one RPS trip unit within the same RPS channel. In addition, some measurement channels may also be used as inputs to Engineered Safety Features (ESF) bistables, and most provide indication in the control room.

Palisades Nuclear Plant B 3.3.1-2 Revised 04/14/2011

RPS Instrumentation B 3.3.1 BASES BACKGROUND Measurement Channels (continued)

(continued)

In the case of Hi Startup Rate and Loss of Load, where fewer than four sensor channels are employed, the reactor trips provided are not relied upon by the plant safety analyses. The sensor channels do however, provide trip input signals to all four RPS channels.

When a channel monitoring a parameter exceeds a predetermined setpoint, indicating an abnormal condition, the bistable monitoring the parameter in that channel will trip. Tripping two or more channels of bistable trip units monitoring the same parameter de-energizes Matrix Logic, (addressed by LCO 3.3.2) which in turn de-energizes the Trip Initiation Logic. This causes all four DC clutch power supplies to de-energize, interrupting power to the control rod drive mechanism clutches, allowing the full length control rods to insert into the core.

For those trips relied upon in the safety analyses, three of the four measurement and trip unit channels can meet the redundancy and testability of GDC 21 in 10 CFR 50, Appendix A (Ref. 1). This LCO requires, however, that four channels be OPERABLE. The fourth channel provides additional flexibility by allowing one channel to be removed from service (trip channel bypassed) for maintenance or testing while still maintaining a minimum two-out-of-three logic.

Since no single failure will prevent a protective system actuation, this arrangement meets the requirements of IEEE Standard 279-1971 (Ref. 3).

Most of the RPS trips are generated by comparing a single measurement to a fixed bistable setpoint. Two trip Functions, Variable High Power Trip and Thermal Margin Low Pressure Trip, make use of more than one measurement to provide a trip.

The required RPS Trip Functions utilize the following input instrumentation:

Variable High Power Trip (VHPT)

The VHPT uses Q Power as its input. Q Power is the higher of NI power from the power range NI drawer and primary calorimetric power (T power) based on PCS hot leg and cold leg temperatures. The measurement channels associated with the VHPT are the power range excore channels, and the PCS hot and cold leg temperature channels.

Palisades Nuclear Plant B 3.3.1-3 Revised 04/14/2011

RPS Instrumentation B 3.3.1 BASES BACKGROUND Measurement Channels (continued)

Variable High Power Trip (VHPT) (continued)

The Thermal Margin Monitors provide the complex signal processing necessary to calculate the TM/LP trip setpoint, VHPT trip setpoint and trip comparison, and Q Power calculation. On power decreases the VHPT setpoint tracks power levels downward so that it is always within a fixed increment above current power, subject to a minimum value.

On power increases, the trip setpoint remains fixed unless manually reset, at which point it increases to the new setpoint, a fixed increment above Q Power at the time of reset, subject to a maximum value. Thus, during power escalation, the trip setpoint must be repeatedly reset to avoid a reactor trip.

High Startup Rate Trip The High Startup Rate trip uses the wide range Nuclear Instruments (NIs) to provide an input signal. There are only two wide range NI channels. The wide range channel signal processing electronics are physically mounted in RPS cabinet channels C (NI-1/3) and D (NI-2/4). Separate bistable trip units mounted within the NI-1/3 wide range channel drawer supply High Startup Rate trip signals to RPS channels A and C. Separate bistable trip units mounted within the NI-2/4 wide range channel drawer provide High Startup Rate trip signals to RPS channels B and D.

Low Primary Coolant Flow Trip The Low Primary Coolant Flow Trip utilizes 16 flow measurement channels which monitor the differential pressure across the primary side of the steam generators. Each RPS channel, A, B, C, and D, receives a signal which is the sum of four differential pressure signals. This totalized signal is compared with a setpoint in the RPS Low Flow bistable trip unit for that RPS channel.

Palisades Nuclear Plant B 3.3.1-4 Revised 04/14/2011

RPS Instrumentation B 3.3.1 BASES BACKGROUND Measurement Channels (continued)

(continued)

Low Steam Generator Level Trips There are two separate Low Steam Generator Level trips, one for each steam generator. Each Low Steam Generator Level trip monitors four level measurement channels for the associated steam generator, one for each RPS channel.

Low Steam Generator Pressure Trips There are also two separate Low Steam Generator Pressure trips, one for each steam generator. Each Low Steam Generator Pressure trip monitors four pressure measurement channels for the associated steam generator, one for each RPS channel.

High Pressurizer Pressure Trip The High Pressurizer Pressure Trip monitors four pressurizer pressure channels, one for each RPS channel.

Thermal Margin Low Pressure (TM/LP) Trip The TM/LP Trip utilizes bistable trip units. Each of these bistable trip units receives a calculated trip setpoint from the Thermal Margin Monitor (TMM) and compares it to the measured pressurizer pressure signal. The TM/LP setpoint is based on Q power (the higher of NI power from the power range NI drawer, or T power, based on PCS hot leg and cold leg temperatures) pressurizer pressure, PCS cold leg temperature, and Axial Shape Index. The TMM provide the complex signal processing necessary to calculate the TM/LP trip setpoint, TM/LP trip comparison signal, and Q Power.

Palisades Nuclear Plant B 3.3.1-5 Revised 04/14/2011

RPS Instrumentation B 3.3.1 BASES BACKGROUND Measurement Channels (continued)

(continued)

Loss of Load Trip The Loss of Load Trip is initiated by two-out-of-three logic from pressure switches in the turbine auto stop oil circuit that sense a turbine trip for input to all four RPS auxiliary trip units. The Loss of Load Trip is actuated by turbine auxiliary relays 305L and 305R.

Relay 305L provides input to RPS channels A and C; 305R to channels B and D. Relays 305L and 305R are energized on a turbine trip. Their inputs are the same as the inputs to the turbine solenoid trip valve, 20ET.

If a turbine trip is generated by loss of auto stop oil pressure, the auto stop oil pressure switches, by two-out-of-three logic, will actuate relays 305L and 305R and generate a reactor trip. If a turbine trip is generated by an input to the solenoid trip valve, relays 305L and 305R, which are wired in parallel, will also be actuated and will generate a reactor trip.

Containment High Pressure Trip The Containment High Pressure Trip is actuated by four pressure switches, one for each RPS channel.

Zero Power Mode Bypass Automatic Removal The Zero Power Bypass allows manually bypassing (i.e., disabling) four reactor trip functions, Low PCS Flow, Low SG A Pressure, Low SG B Pressure, and TM/LP (low PCS pressure),

when reactor power (as indicated by the wide range nuclear instrument channels) is below 10-4%. This bypassing is necessary to allow RPS testing and control rod drive mechanism testing when the reactor is shutdown and plant conditions would cause a reactor trip to be present.

The Zero Power Mode Bypass removal interlock uses the wide range nuclear instruments (NIs) as measurement channels.

There are only two wide range NI channels. Separate bistables are provided to actuate the bypass removal for each RPS channel. Bistables in the NI-1/3 channel provide the bypass removal function for RPS channels A and C; bistables in the NI-2/4 channel for RPS channels B and D.

Palisades Nuclear Plant B 3.3.1-6 Revised 04/14/2011

RPS Instrumentation B 3.3.1 BASES BACKGROUND Several measurement instrument channels provide more than one (continued) required function. Those sensors shared for RPS and ESF functions are identified in Table B 3.3.1-1. That table provides a listing of those shared channels and the Specifications which they affect.

RPS Trip Units Two types of RPS trip units are used in the RPS cabinets; bistable trip units and auxiliary trip units:

A bistable trip unit receives a measured process signal from its instrument channel and compares it to a setpoint; the trip unit actuates three relays, with contacts in the Matrix Logic channels, when the measured signal is less conservative than the setpoint.

They also provide local trip indication and remote annunciation.

An auxiliary trip unit receives a digital input (contacts open or closed); the trip unit actuates three relays, with contacts in the Matrix Logic channels, when the digital input is received. They also provide local trip indication and remote annunciation.

Each RPS channel has four auxiliary trip units and seven bistable trip units.

The contacts from these trip unit relays are arranged into six coincidence matrices, comprising the Matrix Logic. If bistable trip units monitoring the same parameter in at least two channels trip, the Matrix Logic will generate a reactor trip (two-out-of-four logic).

Four of the RPS measurement channels provide contact outputs to the RPS, so the comparison of an analog input to a trip setpoint is not necessary. In these cases, the bistable trip unit is replaced with an auxiliary trip unit. The auxiliary trip units provide contact multiplication so the single input contact opening can provide multiple contact outputs to the coincidence logic as well as trip indication and annunciation.

Palisades Nuclear Plant B 3.3.1-7 Revised 04/14/2011

RPS Instrumentation B 3.3.1 BASES BACKGROUND RPS Trip Units (continued)

(continued)

Trips employing auxiliary trip units include the VHPT, which receives contact inputs from the Thermal Margin Monitors; the High Startup Rate trip which employs contact inputs from bistables mounted in the two wide range drawers; the Loss of Load Trip which receives contact inputs from one of two auxiliary relays which are operated by two-out-of-three logic switches sensing turbine auto stop oil pressure; and the Containment High Pressure (CHP) trip, which employs containment pressure switch contacts.

There are four RPS trip units, designated as channels A through D, each channel having eleven trip units, one for each RPS Function. Trip unit output relays de-energize when a trip occurs.

All RPS Trip Functions, with the exception of the Loss of Load and CHP trips, generate a pretrip alarm as the trip setpoint is approached.

The Allowable Values are specified for each safety related RPS trip Function which is credited in the safety analysis. Nominal trip setpoints are specified in the plant procedures. The nominal setpoints are selected to ensure plant parameters do not exceed the Allowable Value if the instrument loop is performing as required. The methodology used to determine the nominal trip setpoints is also provided in plant documents. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. Each Allowable Value specified is more conservative than the analytical limit determined in the safety analysis in order to account for uncertainties appropriate to the trip Function. These uncertainties are addressed as described in plant documents. A channel is inoperable if its actual setpoint is not within its Allowable Value.

Setpoints in accordance with the Allowable Value will ensure that SLs of Chapter 2.0 are not violated during AOOs and the consequences of DBAs will be acceptable, providing the plant is operated from within the LCOs at the onset of the AOO or DBA and the equipment functions as designed.

Note that in the accompanying LCO 3.3.1, the Allowable Values of Table 3.3.1-1 are the LSSS.

Palisades Nuclear Plant B 3.3.1-8 Revised 04/14/2011

RPS Instrumentation B 3.3.1 BASES BACKGROUND Reactor Protective System Bypasses (continued)

Three different types of trip bypass are utilized in the RPS, Operating Bypass, Zero Power Mode Bypass, and Trip Channel Bypass. The Operating Bypass or Zero Power Mode Bypass prevent the actuation of a trip unit or auxiliary trip unit; the Trip Channel Bypass prevents the trip unit output from affecting the Logic Matrix. A channel which is bypassed, other than as allowed by the Table 3.3.1-1 footnotes, cannot perform its specified safety function and must be considered to be inoperable.

Operating Bypasses The Operating Bypasses are initiated and removed automatically during startup and shutdown as power level changes. An Operating Bypass prevents the associated RPS auxiliary trip unit from receiving a trip signal from the associated measurement channel. With the bypass in place, neither the pre-trip alarm nor the trip will actuate if the measured parameter exceeds the set point. An annunciator is provided for each Operating Bypass. The RPS trips with Operating Bypasses are:

a. High Startup Rate Trip bypass. The High Startup Rate trip is automatically bypassed when the associated wide range channel indicates below 1E-4% RTP, and when the associated power range excore channel indicates above 13% RTP. These bypasses are automatically removed between 1E-4% RTP and 13% RTP.

b. Loss of Load bypass. The Loss of Load trip is automatically bypassed when the associated power range excore channel indicates below 17% RTP. The bypass is automatically removed when the channel indicates above the set point. The same power range excore channel bistable is used to bypass the High Startup Rate trip and the Loss of Load trip for that RPS channel.

Palisades Nuclear Plant B 3.3.1-9 Revised 04/14/2011

RPS Instrumentation B 3.3.1 BASES BACKGROUND Operating Bypasses (continued)

(continued)

Each wide range channel contains two bistables set at 1E-4% RTP, one bistable unit for each associated RPS channel. Each of the two wide range channels affect the Operating Bypasses for two RPS channels; wide range channel NI-1/3 for RPS channels A and C, wide range channel NI-2/4 for RPS channels B and D. Each of the four power range excore channel affects the Operating Bypasses for the associated RPS channel. The power range excore channel bistables associated with the Operating Bypasses are set at a nominal 15%, and are required to actuate between 13% RTP and 17% RTP.

Zero Power Mode (ZPM) Bypass The ZPM Bypass is used when the plant is shut down and it is desired to raise the control rods for control rod drop testing with PCS flow, pressure or temperature too low for the RPS trips to be reset. ZPM bypasses may be manually initiated and removed when wide range power is below 1E-4% RTP, and are automatically removed if the associated wide range NI indicated power exceeds 1E-4% RTP. A ZPM bypass prevents the RPS trip unit from actuating if the measured parameter exceeds the set point. Operation of the pretrip alarm is unaffected by the zero power mode bypass. An annunciator indicates the presence of any ZPM bypass. The RPS trips with ZPM bypasses are:

a. Low Primary Coolant System Flow.

b. Low Steam Generator Pressure.

c. Thermal Margin/Low Pressure.

The wide range NI channels provide contact closure permissive signals when indicated power is below 1E-4% RTP. The ZPM bypasses may then be manually initiated or removed by actuation of key-lock switches.

One key-lock switch located on each RPS cabinet controls the ZPM Bypass for the associated RPS trip channels. The bypass is automatically removed if the associated wide range NI indicated power exceeds 1E-4% RTP. The same wide range NI channel bistables that provide the ZPM Bypass permissive and removal signals also provide the high startup rate trip Operating Bypass actuation and removal.

Palisades Nuclear Plant B 3.3.1-10 Revised 04/14/2011

RPS Instrumentation B 3.3.1 BASES BACKGROUND Trip Channel Bypass (continued)

A Trip Channel Bypass is used when it is desired to physically remove an individual trip unit from the system, or when calibration or servicing of a trip channel could cause an inadvertent trip. A trip Channel Bypass may be manually initiated or removed at any time by actuation of a key-lock switch. A Trip Channel Bypass prevents the trip unit output from affecting the RPS logic matrix. A light above the bypass switch indicates that the trip channel has been bypassed. Each RPS trip unit has an associated trip channel bypass:

The key-lock trip channel bypass switch is located above each trip unit.

The key cannot be removed when in the bypass position. Only one key for each trip parameter is provided, therefore the operator can bypass only one channel of a given parameter at a time. During the bypass condition, system logic changes from two-out-of-four to two-out-of-three channels required for trip.

APPLICABLE Each of the analyzed accidents and transients can be detected by one SAFETY ANALYSES or more RPS Functions. The accident analysis contained in Reference 4 takes credit for most RPS trip Functions. The High Startup Rate and Loss of Load Functions, which are not specifically credited in the accident analysis are part of the NRC approved licensing basis for the plant. The High Startup Rate and Loss of Load trips are purely equipment protective, and their use minimizes the potential for equipment damage.

The specific safety analyses applicable to each protective Function are identified below.

1. Variable High Power Trip (VHPT)

The VHPT provides reactor core protection against positive reactivity excursions.

The safety analysis assumes that this trip is OPERABLE to terminate excessive positive reactivity insertions during power operation and while shut down.

Palisades Nuclear Plant B 3.3.1-11 Revised 04/14/2011

RPS Instrumentation B 3.3.1 BASES APPLICABLE 2. High Startup Rate Trip SAFETY ANALYSIS (continued) There are no safety analyses which take credit for functioning of the High Startup Rate Trip. The High Startup Rate trip is used to trip the reactor when excore wide range power indicates an excessive rate of change. The High Startup Rate trip minimizes transients for events such as a continuous control rod withdrawal or a boron dilution event from low power levels. The trip may be operationally bypassed when THERMAL POWER is

< 1E-4% RTP, when poor counting statistics may lead to erroneous indication. It may also be operationally bypassed at

> 13% RTP, where moderator temperature coefficient and fuel temperature coefficient make high rate of change of power unlikely.

There are only two wide range drawers, with each supplying contact input to auxiliary trip units in two RPS channels.

3. Low Primary Coolant System Flow Trip The Low PCS Flow trip provides DNB protection during events which suddenly reduce the PCS flow rate during power operation, such as loss of power to, or seizure of, a primary coolant pump.

Flow in each of the four PCS loops is determined from pressure drop from inlet to outlet of the SGs. The total PCS flow is determined, for the RPS flow channels, by summing the loop pressure drops across the SGs and correlating this pressure sum with the sum of SG differential pressures which exist at 100% flow (four pump operation at full power Tave). Full PCS flow is that flow which exists at RTP, at full power Tave, with four pumps operating.

4, 5. Low Steam Generator Level Trip The Low Steam Generator Level trips are provided to trip the reactor in the event of excessive steam demand (to prevent overcooling the PCS) and loss of feedwater events (to prevent overpressurization of the PCS).

The Allowable Value assures that there will be sufficient water inventory in the SG at the time of trip to allow a safe and orderly plant shutdown and to prevent SG dryout assuming minimum AFW capacity.

Palisades Nuclear Plant B 3.3.1-12 Revised 04/14/2011

RPS Instrumentation B 3.3.1 BASES APPLICABLE 4, 5. Low Steam Generator Level Trip (continued)

SAFETY ANALYSIS (continued) Each SG level is sensed by measuring the differential pressure in the upper portion of the downcomer annulus in the SG. These trips share four level sensing channels on each SG with the AFW actuation signal.

6, 7. Low Steam Generator Pressure Trip The Low Steam Generator Pressure trip provides protection against an excessive rate of heat extraction from the steam generators, which would result in a rapid uncontrolled cooldown of the PCS. This trip provides a mitigation function in the event of an MSLB.

The Low SG Pressure channels are shared with the Low SG Pressure signals which isolate the steam and feedwater lines.

8. High Pressurizer Pressure Trip The High Pressurizer Pressure trip, in conjunction with pressurizer safety valves and Main Steam Safety Valves (MSSVs), provides protection against overpressure conditions in the PCS when at operating temperature. The safety analyses assume the High Pressurizer Pressure trip is OPERABLE during accidents and transients which suddenly reduce PCS cooling (e.g., Loss of Load, Main Steam Isolation Valve (MSIV) closure, etc.) or which suddenly increase reactor power (e.g., rod ejection accident).

The High Pressurizer Pressure trip shares four safety grade instrument channels with the TM/LP trip, Anticipated Transient Without Scram (ATWS) and PORV circuits, and the Pressurizer Low Pressure Safety Injection Signal.

Palisades Nuclear Plant B 3.3.1-13 Revised 04/14/2011

RPS Instrumentation B 3.3.1 BASES APPLICABLE 9. Thermal Margin/Low Pressure (TM/LP) Trip SAFETY ANALYSIS (continued) The TM/LP trip is provided to prevent reactor operation when the DNBR is insufficient. The TM/LP trip protects against slow reactivity or temperature increases, and against pressure decreases.

The trip is initiated whenever the PCS pressure signal drops below a minimum value (Pmin) or a computed value (Pvar) as described below, whichever is higher.

The TM/LP trip uses Q Power, ASI, pressurizer pressure, and cold leg temperature (Tc) as inputs.

Q Power is the higher of core THERMAL POWER (T Power) or nuclear power. The T power uses hot leg and cold leg RTDs as inputs. Nuclear power uses the power range excore channels as inputs. Both the T and excore power signals have provisions for calibration by calorimetric calculations.

The ASI is calculated from the upper and lower power range excore detector signals, as explained in Section 1.1, Definitions.

The signal is corrected for the difference between the flux at the core periphery and the flux at the detectors.

The Tc value is the higher of the two cold leg signals.

The Low Pressurizer Pressure trip limit (P var)is calculated using the equations given in Table 3.3.1-2.

The calculated limit (Pvar) is then compared to a fixed Low Pressurizer Pressure trip limit (Pmin). The auctioneered highest of these signals becomes the trip limit (Ptrip). Ptrip is compared to the measured PCS pressure and a trip signal is generated when the measured pressure for that channel is less than or equal to Ptrip. A pre-trip alarm is also generated when P is less than or equal to the pre-trip setting, Ptrip + P.

The TM/LP trip setpoint is a complex function of these inputs and represents a minimum acceptable PCS pressure for the existing temperature and power conditions. It is compared to actual PCS pressure in the TM/LP trip unit.

Palisades Nuclear Plant B 3.3.1-14 Revised 04/14/2011

RPS Instrumentation B 3.3.1 BASES APPLICABLE 10. Loss of Load Trip SAFETY ANALYSIS (continued) There are no safety analyses which take credit for functioning of the Loss of Load Trip.

The Loss of Load trip is provided to prevent lifting the pressurizer and main steam safety valves in the event of a turbine generator trip while at power. The trip is equipment protective. The safety analyses do not assume that this trip functions during any accident or transient. The Loss of Load trip uses two-out-of-three logic from pressure switches in the turbine auto stop oil circuit to sense a turbine trip for input to all four RPS auxiliary trip units.

11. Containment High Pressure Trip The Containment High Pressure trip provides a reactor trip in the event of a Loss of Coolant Accident (LOCA) or Main Steam Line Break (MSLB). The Containment High Pressure trip shares sensors with the Containment High Pressure sensing logic for Safety Injection, Containment Isolation, and Containment Spray.

Each of these sensors has a single bellows which actuates two microswitches. One microswitch on each of four sensors provides an input to the RPS.

12. Zero Power Mode Bypass Removal The only RPS bypass considered in the safety analyses is the Zero Power Mode (ZPM) Bypass. The ZPM Bypass is used when the plant is shut down and it is desired to raise the control rods for control rod drop testing with PCS flow or temperature too low for the RPS Low PCS Flow, Low SG Pressure, or Thermal Margin/Low Pressure trips to be reset. ZPM bypasses are automatically removed if the wide range NI indicated power exceeds 1E-4% RTP.

Palisades Nuclear Plant B 3.3.1-15 Revised 04/14/2011

RPS Instrumentation B 3.3.1 BASES APPLICABLE 12. Zero Power Mode Bypass Removal (continued)

SAFETY ANALYSIS (continued) The safety analyses take credit for automatic removal of the ZPM Bypass if reactor criticality due to a Continuous Control Rod Bank Withdrawal should occur with the affected trips bypassed and PCS flow, pressure, or temperature below the values at which the RPS could be reset. The ZPM Bypass would effectively be removed when the first wide range NI channel indication reached 1E-4% RTP. With the ZPM Bypass for two RPS channels removed, the RPS would trip on one of the un-bypassed trips.

This would prevent the reactor reaching an excessive power level.

If a reactor criticality due to a Continuous Control Rod Bank Withdrawal should occur when PCS flow, steam generator pressure, and PCS pressure (TM/LP) were above their trip setpoints, a trip would terminate the event when power increased to the minimum setting (nominally 30%) of the Variable High Power Trip. In this case, the monitored parameters are at or near their normal operational values, and a trip initiated at 30% RTP provides adequate protection.

The RPS design also includes automatic removal of the Operating Bypasses for the High Startup Rate and Loss of Load trips. The safety analyses do not assume functioning of either these trips or the automatic removal of their bypasses.

The RPS instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2).

LCO The LCO requires all instrumentation performing an RPS Function to be OPERABLE. Failure of the trip unit (including its output relays), any required portion of the associated instrument channel, or both, renders the affected channel(s) inoperable and reduces the reliability of the affected Functions. Failure of an automatic ZPM bypass removal channel may also impact the associated instrument channel(s) and reduce the reliability of the affected Functions.

Palisades Nuclear Plant B 3.3.1-16 Revised 04/14/2011

RPS Instrumentation B 3.3.1 BASES LCO Actions allow Trip Channel Bypass of individual channels, but the (continued) bypassed channel must be considered to be inoperable. The bypass key used to bypass a single channel cannot be simultaneously used to bypass that same parameter in other channels. This interlock prevents operation with more than one channel of the same Function trip channel bypassed. The plant is normally restricted to 7 days in a trip channel bypass, or otherwise inoperable condition before either restoring the Function to four channel operation (two-out-of-four logic) or placing the channel in trip (one-out-of-three logic).

The Allowable Values are specified for each safety related RPS trip Function which is credited in the safety analysis. Nominal trip setpoints are specified in the plant procedures. The nominal setpoints are selected to ensure plant parameters do not exceed the Allowable Value if the instrument loop is performing as required. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. Each Allowable Value specified is more conservative than the analytical limit determined in the safety analysis in order to account for uncertainties appropriate to the trip Function.

These uncertainties are addressed as described in plant documents.

Neither Allowable Values nor setpoints are specified for the non-safety related RPS Trip Functions, since no safety analysis assumptions would be violated if they are not set at a particular value.

The following Bases for each trip Function identify the above RPS trip Function criteria items that are applicable to establish the trip Function OPERABILITY.

1. Variable High Power Trip (VHPT)

This LCO requires all four channels of the VHPT Function to be OPERABLE.

The Allowable Value is high enough to provide an operating envelope that prevents unnecessary VHPT trips during normal plant operations. The Allowable Value is low enough for the system to function adequately during reactivity addition events.

Palisades Nuclear Plant B 3.3.1-17 Revised 04/14/2011

RPS Instrumentation B 3.3.1 BASES LCO 1. Variable High Power Trip (VHPT) (continued)

(continued)

The VHPT is designed to limit maximum reactor power to its maximum design and to terminate power excursions initiating at lower powers without power reaching this full power limit. During plant startup, the VHPT trip setpoint is initially at its minimum value, 30%. Below 30% RTP, the VHPT setpoint is not required to track with Q Power, i.e., be adjusted to within 15% RTP. It remains fixed until manually reset, at which point it increases to 15% above existing Q Power.

The maximum allowable setting of the VHPT is 109.4% RTP.

Adding to this the possible variation in trip setpoint due to calibration and instrument error, the maximum actual steady state power at which a trip would be actuated is 113.4%, which is the value assumed in the safety analysis.

2. High Startup Rate Trip This LCO requires four channels of High Startup Rate Trip Function to be OPERABLE in MODES 1 and 2.

The High Startup Rate trip serves as a backup to the administratively enforced startup rate limit. The Function is not credited in the accident analyses; therefore, no Allowable Value for the trip or operating bypass Functions is derived from analytical limits and none is specified.

The four channels of the High Startup Rate trip are derived from two wide range NI signal processing drawers. Thus, a failure in one wide range channel could render two RPS channels inoperable. It is acceptable to continue operation in this condition because the High Startup Rate trip is not credited in any safety analyses.

The requirement for this trip Function is modified by a footnote, which allows the High Startup Rate trip to be bypassed when the wide range NI indicates below 10E-4% or when THERMAL POWER is above 13% RTP. If a High Startup Rate trip is bypassed when power is between these limits, it must be considered to be inoperable.

Palisades Nuclear Plant B 3.3.1-18 Revised 04/14/2011

RPS Instrumentation B 3.3.1 BASES LCO 3. Low Primary Coolant System Flow Trip (continued)

This LCO requires four channels of Low PCS Flow Trip Function to be OPERABLE.

This trip is set high enough to maintain fuel integrity during a loss of flow condition. The setting is low enough to allow for normal operating fluctuations from offsite power.

The Low PCS Flow trip setpoint of 95% of full PCS flow insures that the reactor cannot operate when the flow rate is less than 93% of the nominal value considering instrument errors. Full PCS flow is that flow which exists at RTP, at full power Tave, with four pumps operating.

The requirement for this trip Function is modified by a footnote, which allows use of the ZPM bypass when wide range power is below 1E-4% RTP. That bypass is automatically removed when the associated wide range channel indicates 1E-4% RTP. If a trip channel is bypassed when power is above 1E-4% RTP, it must be considered to be inoperable.

4, 5. Low Steam Generator Level Trip This LCO requires four channels of Low Steam Generator Level Trip Function per steam generator to be OPERABLE.

The 25.9% Allowable Value assures that there is an adequate water inventory in the steam generators when the reactor is critical and is based upon narrow range instrumentation. The 25.9%

indicated level corresponds to the location of the feed ring.

6, 7. Low Steam Generator Pressure Trip This LCO requires four channels of Low Steam Generator Pressure Trip Function per steam generator to be OPERABLE.

The Allowable Value of 500 psia is sufficiently below the full load operating value for steam pressure so as not to interfere with normal plant operation, but still high enough to provide the required protection in the event of excessive steam demand.

Since excessive steam demand causes the PCS to cool down, resulting in positive reactivity addition to the core, a reactor trip is required to offset that effect.

Palisades Nuclear Plant B 3.3.1-19 Revised 04/14/2011

RPS Instrumentation B 3.3.1 BASES LCO (continued) 8. High Pressurizer Pressure Trip This LCO requires four channels of High Pressurizer Pressure Trip Function to be OPERABLE.

The Allowable Value is set high enough to allow for pressure increases in the PCS during normal operation (i.e., plant transients) not indicative of an abnormal condition. The setting is below the lift setpoint of the pressurizer safety valves and low enough to initiate a reactor trip when an abnormal condition is indicated.

9. Thermal Margin/Low Pressure (TM/LP) Trip This LCO requires four channels of TM/LP Trip Function to be OPERABLE.

The TM/LP trip setpoints are derived from the core thermal limits through application of appropriate allowances for measurement uncertainties and processing errors. The allowances specifically account for instrument drift in both power and inlet temperatures, calorimetric power measurement, inlet temperature measurement, and primary system pressure measurement.

Other uncertainties including allowances for assembly power tilt, fuel pellet manufacturing tolerances, core flow measurement uncertainty and core bypass flow, inlet temperature measurement time delays, and ASI measurement, are included in the development of the TM/LP trip setpoint used in the accident analysis.

The requirement for this trip Function is modified by a footnote, which allows use of the ZPM bypass when wide range power is below 1E-4% RTP. That bypass is automatically removed when the associated wide range channel indicates 1E-4% RTP. If a trip channel is bypassed when power is above 1E-4% RTP, it must be considered to be inoperable.

Palisades Nuclear Plant B 3.3.1-20 Revised 04/14/2011

RPS Instrumentation B 3.3.1 BASES LCO 10. Loss of Load Trip (continued)

The LCO requires four Loss of Load Trip Function channels to be OPERABLE in MODE 1 with THERMAL POWER 17% RTP.

The Loss of Load trip may be bypassed or be inoperable with THERMAL POWER < 17% RTP, since it is no longer needed to prevent lifting of the pressurizer safety valves or steam generator safety valves in the event of a Loss of Load. Loss of Load Trip unit must be considered inoperable if it is bypassed when THERMAL POWER is above 17% RTP.

This LCO requires four RPS Loss of Load auxiliary trip units, relays 305L and 305R, and pressure switches 63/AST-1, 63/AST-2, and 63/AST-3 to be OPERABLE. With those components OPERABLE, a turbine trip will generate a reactor trip.

The LCO does not require the various turbine trips, themselves, to be OPERABLE.

The Nuclear Steam Supply System and Steam Dump System are capable of accommodating the Loss of Load without requiring the use of the above equipment.

The Loss of Load Trip Function is not credited in the accident analysis; therefore, an Allowable Value for the trip cannot be derived from analytical limits, and is not specified.

11. Containment High Pressure Trip This LCO requires four channels of Containment High Pressure Trip Function to be OPERABLE.

The Allowable Value is high enough to allow for small pressure increases in containment expected during normal operation (i.e., plant heatup) that are not indicative of an abnormal condition.

The setting is low enough to initiate a reactor trip to prevent containment pressure from exceeding design pressure following a DBA and ensures the reactor is shutdown before initiation of safety injection and containment spray.

Palisades Nuclear Plant B 3.3.1-21 Revised 04/14/2011

RPS Instrumentation B 3.3.1 BASES LCO (continued) 12. ZPM Bypass The LCO requires that four channels of automatic Zero Power Mode (ZPM) Bypass removal instrumentation be OPERABLE.

Each channel of automatic ZPM Bypass removal includes a shared wide range NI channel, an actuating bistable in the wide range drawer, and a relay in the associated RPS cabinet. Wide Range NI channel 1/3 is shared between ZPM Bypass removal channels A and C; Wide Range NI channel 2/4, between ZPM Bypass removal channels B and D. An operable bypass removal channel must be capable of automatically removing the capability to bypass the affected RPS trip channels with the ZPM Bypass key switch at the proper setpoint.

APPLICABILITY This LCO requires all safety related trip functions to be OPERABLE in accordance with Table 3.3.1-1.

Those RPS trip Functions which are assumed in the safety analyses (all except High Startup Rate and Loss of Load), are required to be operable in MODES 1 and 2, and in MODES 3, 4, and 5 with more than one full-length control rod capable of being withdrawn and PCS boron concentration less than REFUELING BORON CONCENTRATION.

These trip Functions are not required while in MODES 3, 4, or 5, if PCS boron concentration is at REFUELING BORON CONCENTRATION, or when no more than one full-length control rod is capable of being withdrawn, because the RPS Function is already fulfilled. REFUELING BORON CONCENTRATION provides sufficient negative reactivity to assure the reactor remains subcritical regardless of control rod position, and the safety analyses assume that the highest worth withdrawn full-length control rod will fail to insert on a trip. Therefore, under these conditions, the safety analyses assumptions will be met without the RPS trip Function.

The High Startup Rate Trip Function is required to be OPERABLE in MODES 1 and 2, but may be bypassed when the associated wide range NI channel indicates below 1E-4% power, when poor counting statistics may lead to erroneous indication. In MODES 3, 4, 5, and 6, the High Startup Rate trip is not required to be OPERABLE. Wide range channels are required to be OPERABLE in MODES 3, 4, and 5, by LCO 3.3.9, "Neutron Flux Monitoring Channels," and in MODE 6, by LCO 3.9.2, Nuclear Instrumentation.

Palisades Nuclear Plant B 3.3.1-22 Revised 04/14/2011

RPS Instrumentation B 3.3.1 BASES APPLICABILITY (continued) The High Startup Rate Trip Function is required to be OPERABLE in MODES 1 and 2, but may be bypassed when the associated wide range NI channel indicates below 1E-4% power, when poor counting statistics may lead to erroneous indication. In MODES 3, 4, 5, and 6, the High Startup Rate trip is not required to be OPERABLE. Wide range channels are required to be OPERABLE in MODES 3, 4, and 5, by LCO 3.3.9, "Neutron Flux Monitoring Channels," and in MODE 6, by LCO 3.9.2, Nuclear Instrumentation.

The Loss of Load trip is required to be OPERABLE with THERMAL POWER at or above 17% RTP. Below 17% RTP, the ADVs are capable of relieving the pressure due to a Loss of Load event without challenging other overpressure protection.

The trips are designed to take the reactor subcritical, maintaining the SLs during AOOs and assisting the ESF in providing acceptable consequences during accidents.

ACTIONS The most common causes of channel inoperability are outright failure of loop components or drift of those loop components which is sufficient to exceed the tolerance provided in the plant setpoint analysis. Loop component failures are typically identified by the actuation of alarms due to the channel failing to the safe condition, during CHANNEL CHECKS (when the instrument is compared to the redundant channels), or during the CHANNEL FUNCTIONAL TEST (when an automatic component might not respond properly). Typically, the drift of the loop components is found to be small and results in a delay of actuation rather than a total loss of function. Excessive loop component drift would, most likely, be identified during a CHANNEL CHECK (when the instrument is compared to the redundant channels) or during a CHANNEL CALIBRATION (when instrument loop components are checked against reference standards).

In the event a channel's trip setpoint is found nonconservative with respect to the Allowable Value, or the transmitter, instrument loop, signal processing electronics, or RPS bistable trip unit is found inoperable, all affected Functions provided by that channel must be declared inoperable, and the plant must enter the Condition for the particular protection Functions affected.

Palisades Nuclear Plant B 3.3.1-23 Revised 04/14/2011

RPS Instrumentation B 3.3.1 BASES ACTIONS (continued) When the number of inoperable channels in a trip Function exceeds that specified in any related Condition associated with the same trip Function, then the plant is outside the safety analysis. Therefore, LCO 3.0.3 is immediately entered if applicable in the current MODE of operation.

A Note has been added to the ACTIONS to clarify the application of the Completion Time rules. The Conditions of this Specification may be entered independently for each Function. The Completion Times of each inoperable Function will be tracked separately for each Function, starting from the time the Condition was entered.

A.1 Condition A applies to the failure of a single channel in any required RPS Function, except High Startup Rate, Loss of Load, or ZPM Bypass Removal. (Condition A is modified by a Note stating that this Condition does not apply to the High Startup Rate, Loss of Load, or ZPM Bypass Removal Functions. The failure of one channel of those Functions is addressed by Conditions B, C, or D.)

If one RPS bistable trip unit or associated instrument channel is inoperable, operation is allowed to continue. Since the trip unit and associated instrument channel combine to perform the trip function, this Condition is also appropriate if both the trip unit and the associated instrument channel are inoperable. Though not required, the inoperable channel may be bypassed. The provision of four trip channels allows one channel to be bypassed (removed from service) during operations, placing the RPS in two-out-of-three coincidence logic. The failed channel must be restored to OPERABLE status or placed in trip within 7 days.

Required Action A.1 places the Function in a one-out-of-three configuration. In this configuration, common cause failure of dependent channels cannot prevent trip.

The Completion Time of 7 days is based on operating experience, which has demonstrated that a random failure of a second channel occurring during the 7 day period is a low probability event.

Palisades Nuclear Plant B 3.3.1-24 Revised 04/14/2011

RPS Instrumentation B 3.3.1 BASES ACTIONS A.1 (continued)

(continued)

The Completion Time of 7 days is based on operating experience, which has demonstrated that a random failure of a second channel occurring during the 7 day period is a low probability event.

B.1 Condition B applies to the failure of a single High Startup Rate trip unit or associated instrument channel.

If one trip unit or associated instrument channel fails, it must be restored to OPERABLE status prior to entering MODE 2 from MODE 3. A shutdown provides the appropriate opportunity to repair the trip function and conduct the necessary testing. The Completion Time is based on the fact that the safety analyses take no credit for the functioning of this trip.

C.1 Condition C applies to the failure of a single Loss of Load or associated instrument channel.

If one trip unit or associated instrument channel fails, it must be restored to OPERABLE status prior to THERMAL POWER 17% RTP following a shutdown. If the plant is shutdown at the time the channel becomes inoperable, then the failed channel must be restored to OPERABLE status prior to THERMAL POWER 17% RTP. For this Completion Time, following a shutdown means this Required Action does not have to be completed until prior to THERMAL POWER ³ 17% RTP for the first time after the plant has been in MODE 3 following entry into the Condition. The Completion Time trip assures that the plant will not be restarted with an inoperable Loss of Load trip channel.

Palisades Nuclear Plant B 3.3.1-25 Revised 04/14/2011

RPS Instrumentation B 3.3.1 BASES ACTIONS D.1 and D.2 (continued)

Condition D applies when one or more automatic ZPM Bypass removal channels are inoperable. If the ZPM Bypass removal channel cannot be restored to OPERABLE status, the affected ZPM Bypasses must be immediately removed, or the bypassed RPS trip Function channels must be immediately declared to be inoperable. Unless additional circuit failures exist, the ZPM Bypass may be removed by placing the associated Zero Power Mode Bypass key operated switch in the normal position.

A trip channel which is actually bypassed, other than as allowed by the Table 3.3.1-1 footnotes, cannot perform its specified safety function and must immediately be declared to be inoperable.

E.1 and E.2 Condition E applies to the failure of two channels in any RPS Function, except ZPM Bypass Removal Function. (The failure of ZPM Bypass Removal Functions is addressed by Condition D.).

Condition E is modified by a Note stating that this Condition does not apply to the ZPM Bypass Removal Function.

Required Action E.1 provides for placing one inoperable channel in trip within the Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . Though not required, the other inoperable channel may be (trip channel) bypassed.

Palisades Nuclear Plant B 3.3.1-26 Revised 04/14/2011

RPS Instrumentation B 3.3.1 BASES ACTIONS E.1 and E.2 (continued)

(continued)

This Completion Time is sufficient to allow the operator to take all appropriate actions for the failed channels while ensuring that the risk involved in operating with the failed channels is acceptable. With one channel of protective instrumentation bypassed or inoperable in an untripped condition, the RPS is in a two-out-of-three logic for that function; but with another channel failed, the RPS may be operating in a two-out-of-two logic. This is outside the assumptions made in the analyses and should be corrected. To correct the problem, one of the inoperable channels is placed in trip. This places the RPS in a one-out-of-two for that function logic. If any of the other unbypassed channels for that function receives a trip signal, the reactor will trip.

Action E.2 is modified by a Note stating that this Action does not apply to (is not required for) the High Startup Rate and Loss of Load Functions.

One channel is required to be restored to OPERABLE status within 7 days for reasons similar to those stated under Condition A. After one channel is restored to OPERABLE status, the provisions of Condition A still apply to the remaining inoperable channel. Therefore, the channel that is still inoperable after completion of Required Action E.2 must be placed in trip if more than 7 days have elapsed since the initial channel failure.

F.1 The power range excore channels are used to generate the internal ASI signal used as an input to the TM/LP trip. They also provide input to the Thermal Margin Monitors for determination of the Q Power input for the TM/LP trip and the VHPT. If two power range excore channels cannot be restored to OPERABLE status, power is restricted or reduced during subsequent operations because of increased uncertainty associated with inoperable power range excore channels which provide input to those trips.

The Completion Time of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months is adequate to reduce power in an orderly manner without challenging plant systems.

Palisades Nuclear Plant B 3.3.1-27 Revised 04/14/2011

RPS Instrumentation B 3.3.1 BASES ACTIONS G.1, G.2.1, and G.2.2 (continued)

Condition G is entered when the Required Action and associated Completion Time of Condition A, B, C, D, E, or F are not met, or if the control room ambient air temperature exceeds 90°F.

If the control room ambient air temperature exceeds 90°F, all Thermal Margin Monitor channels are rendered inoperable because their operating temperature limit is exceeded. In this condition, or if the Required Actions and associated Completion Times are not met, the reactor must be placed in a condition in which the LCO does not apply.

To accomplish this, the plant must be placed in MODE 3, with no more than one full-length control rod capable of being withdrawn or with the PCS boron concentration at REFUELING BORON CONCENTRATION in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months .

The Completion Time is reasonable, based on operating experience, for placing the plant in MODE 3 from full power conditions in an orderly manner and without challenging plant systems. The Completion Time is also reasonable to ensure that no more than one full-length control rod is capable of being withdrawn or that the PCS boron concentration is at REFUELING BORON CONCENTRATION.

SURVEILLANCE The SRs for any particular RPS Function are found in the SR column of REQUIREMENTS Table 3.3.1-1 for that Function. Most Functions are subject to CHANNEL CHECK, CHANNEL FUNCTIONAL TEST, and CHANNEL CALIBRATION.

SR 3.3.1.1 Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures that gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. Under most conditions, a CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Palisades Nuclear Plant B 3.3.1-28 Revised 04/14/2011

RPS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.1 (continued)

REQUIREMENTS (continued) Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the transmitter or the signal processing equipment has drifted outside its limits.

The Containment High Pressure and Loss of Load channels are pressure switch actuated. As such, they have no associated control room indicator and do not require a CHANNEL CHECK.

The Frequency, about once every shift, is based on operating experience that demonstrates the rarity of channel failure. Since the probability of two random failures in redundant channels in any 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months period is extremely low, the CHANNEL CHECK minimizes the chance of loss of protective function due to failure of redundant channels. The CHANNEL CHECK supplements less formal, but more frequent, checks of channel OPERABILITY during normal operational use of the displays associated with the LCO required channels.

SR 3.3.1.2 This SR verifies that the control room ambient air temperature is within the environmental qualification temperature limits for the most restrictive RPS components, which are the Thermal Margin Monitors. These monitors provide input to both the VHPT Function and the TM/LP Trip Function. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is reasonable based on engineering judgment and plant operating experience.

SR 3.3.1.3 A daily calibration (heat balance) is performed when THERMAL POWER is 15%. The daily calibration consists of adjusting the "nuclear power calibrate" potentiometers to agree with the calorimetric calculation if the absolute difference is 1.5%. Nuclear power is adjusted via a potentiometer, or THERMAL POWER is adjusted via a Thermal Margin Monitor bias number, as necessary, in accordance with the daily calibration (heat balance) procedure. Performance of the daily calibration ensures that the two inputs to the Q power measurement are indicating accurately with respect to the much more accurate secondary calorimetric calculation.

Palisades Nuclear Plant B 3.3.1-29 Revised 04/14/2011

RPS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.3 (continued)

REQUIREMENTS (continued) The Frequency of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is based on plant operating experience and takes into account indications and alarms located in the control room to detect deviations in channel outputs.

The Frequency is modified by a Note indicating this Surveillance must be performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after THERMAL POWER is 15% RTP.

The secondary calorimetric is inaccurate at lower power levels. The 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allows time requirements for plant stabilization, data taking, and instrument calibration.

SR 3.3.1.4 It is necessary to calibrate the power range excore channel upper and lower subchannel amplifiers such that the measured ASI reflects the true core power distribution as determined by the incore detectors. ASI is utilized as an input to the TM/LP trip function where it is used to ensure that the measured axial power profiles are bounded by the axial power profiles used in the development of the T inlet limitation of LCO 3.4.1. An adjustment of the excore channel is necessary only if reactor power is greater than 25% RTP and individual excore channel ASI differs from AXIAL OFFSET, as measured by the incores, outside the bounds of the following table:

Allowed Group 4 Group 4 Reactor Rods 128" withdrawn Rods <128" withdrawn Power 100% -0.020 (AO-ASI) 0.020 -0.040 (AO-ASI) 0.040

< 95 -0.033 (AO-ASI) 0.020 -0.053 (AO-ASI) 0.040

< 90 -0.046 (AO-ASI) 0.020 -0.066 (AO-ASI) 0.040

< 85 -0.060 (AO-ASI) 0.020 -0.080 (AO-ASI) 0.040

< 80 -0.120 (AO-ASI) 0.080 -0.140 (AO-ASI) 0.100

< 75 -0.120 (AO-ASI) 0.080 -0.140 (AO-ASI) 0.100

< 70 -0.120 (AO-ASI) 0.080 -0.140 (AO-ASI) 0.100

< 65 -0.120 (AO-ASI) 0.080 -0.140 (AO-ASI) 0.100

< 60 -0.160 (AO-ASI) 0.120 -0.180 (AO-ASI) 0.140

< 55 -0.160 (AO-ASI) 0.120 -0.180 (AO-ASI) 0.140

< 50 -0.160 (AO-ASI) 0.120 -0.180 (AO-ASI) 0.140

< 45 -0.160 (AO-ASI) 0.120 -0.180 (AO-ASI) 0.140

< 40 -0.160 (AO-ASI) 0.120 -0.180 (AO-ASI) 0.140

< 35 -0.160 (AO-ASI) 0.120 -0.180 (AO-ASI) 0.140

< 30 -0.160 (AO-ASI) 0.120 -0.180 (AO-ASI) 0.140

< 25 Below 25% RTP any AO/ASI difference is acceptable Table values determined with a conservative P var gamma constant of -9505.

Palisades Nuclear Plant B 3.3.1-30 Revised 04/14/2011

RPS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.4 (continued)

REQUIREMENTS (continued) Below 25% RTP any difference between ASI and AXIAL OFFSET is acceptable. A Note indicates the Surveillance is not required to have been performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after THERMAL POWER is 25% RTP.

Uncertainties in the excore and incore measurement process make it impractical to calibrate when THERMAL POWER is < 25% RTP. The 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allows time for plant stabilization, data taking, and instrument calibration.

The 31 day Frequency is adequate, based on operating experience of the excore linear amplifiers and the slow burnup of the detectors. The excore readings are a strong function of the power produced in the peripheral fuel bundles and do not represent an integrated reading across the core. Slow changes in neutron flux during the fuel cycle can also be detected at this Frequency.

SR 3.3.1.5 A CHANNEL FUNCTIONAL TEST is performed on each RPS instrument channel, except Loss of Load and High Startup Rate, every 92 days to ensure the entire channel will perform its intended function when needed. For the TM/LP Function, the constants associated with the Thermal Margin Monitors must be verified to be within tolerances.

A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.

Any setpoint adjustment must be consistent with the assumptions of the current setpoint analysis.

The Frequency of 92 days is based on the reliability analysis presented in topical report CEN-327, "RPS/ESFAS Extended Test Interval Evaluation" (Ref. 5).

Palisades Nuclear Plant B 3.3.1-31 Revised 04/14/2011

RPS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.6 REQUIREMENTS (continued) A calibration check of the power range excore channels using the internal test circuitry is required every 92 days. This SR uses an internally generated test signal to check that the 0% and 50% levels read within limits for both the upper and lower detector, both on the analog meter and on the TMM screen. This check verifies that neither the zero point nor the amplifier gain adjustment have undergone excessive drift since the previous complete CHANNEL CALIBRATION.

The Frequency of 92 days is acceptable, based on plant operating experience, and takes into account indications and alarms available to the operator in the control room.

SR 3.3.1.7 A CHANNEL FUNCTIONAL TEST on the Loss of Load and High Startup Rate channels is performed prior to a reactor startup to ensure the entire channel will perform its intended function.

A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.

The High Startup Rate trip is actuated by either of the Wide Range Nuclear Instrument Startup Rate channels. NI-1/3 sends a trip signal to RPS channels A and C; NI-2/4 to channels B and D. Since each High Startup Rate channel would cause a trip on two RPS channels, the High Startup Rate trip is not tested when the reactor is critical.

The four Loss of Load Trip channels are all actuated by a single pressure switch monitoring turbine auto stop oil pressure which is not tested when the reactor is critical. Operating experience has shown that these components usually pass the Surveillance when performed at a Frequency of once per 7 days prior to each reactor startup.

Palisades Nuclear Plant B 3.3.1-32 Revised 04/14/2011

RPS Instrumentation B 3.3.1 BASES SURVEILLANCE SR 3.3.1.8 REQUIREMENTS (continued) SR 3.3.1.8 is the performance of a CHANNEL CALIBRATION every 18 months.

CHANNEL CALIBRATION is a complete check of the instrument channel including the sensor (except neutron detectors). The Surveillance verifies that the channel responds to a measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drift between successive calibrations to ensure that the channel remains operational between successive tests. CHANNEL CALIBRATIONS must be consistent with the setpoint analysis.

The bistable setpoints must be found to trip within the Allowable Values specified in the LCO and left set consistent with the assumptions of the setpoint analysis. The Variable High Power Trip setpoint shall be verified to reset properly at several indicated power levels during (simulated) power increases and power decreases.

The as-found and as-left values must also be recorded and reviewed for consistency with the assumptions of the setpoint analysis.

As part of the CHANNEL CALIBRATION of the wide range Nuclear Instrumentation, automatic removal of the ZPM Bypass for the Low PCS Flow, TM/LP must be verified to assure that these trips are available when required.

The Frequency is based upon the assumption of an 18 month calibration interval for the determination of the magnitude of equipment drift.

This SR is modified by a Note which states that it is not necessary to calibrate neutron detectors because they are passive devices with minimal drift and because of the difficulty of simulating a meaningful signal. Slow changes in power range excore neutron detector sensitivity are compensated for by performing the daily calorimetric calibration (SR 3.3.1.3) and the monthly calibration using the incore detectors (SR 3.3.1.4). Sudden changes in detector performance would be noted during the required CHANNEL CHECKS (SR 3.3.1.1).

Palisades Nuclear Plant B 3.3.1-33 Revised 04/14/2011

RPS Instrumentation B 3.3.1 BASES REFERENCES 1. 10 CFR 50, Appendix A, GDC 21

2. 10 CFR 100

3. IEEE Standard 279-1971, April 5, 1972

4. FSAR, Chapter 14

5. CEN-327, June 2, 1986, including Supplement 1, March 3, 1989 Palisades Nuclear Plant B 3.3.1-34 Revised 04/14/2011

RPS Instrumentation B 3.3.1 Table B 3.3.1-1 (page 1 of 1)

Instruments Affecting Multiple Specifications Required Instrument Channels Affected Specifications Nuclear Instrumentation Source Range NI-1/3, Count Rate Indication @ C-150 Panel 3.3.8 (#1)

Source Range NI-1/3 & 2/4, Count Rate Signal 3.3.9 & 3.9.2

-4 Wide Range NI-1/3 & 2/4, Flux Level 10 Bypass 3.3.1 (#3, 6, 7, 9, & 12)

Wide Range NI-1/3 & 2/4, Startup Rate 3.3.1 (#2)

Wide Range NI-1/3 & 2/4, Flux Level Indication @EC-06 Panel for 3.3.7 3.3.7 (#3) & 3.3.9 Power Range NI-5, 6, 7, & 8, Tq 3.2.1 & 3.2.3 Power Range NI-5, 6, 7, & 8, Q Power 3.3.1 (#1 & 9)

Power Range NI-5, 6, 7, & 8, ASI 3.3.1 (#9) & 3.2.1 & 3.2.4 Power Range NI-5, 6, 7, & 8, Loss of Load/High Startup Rate Bypass 3.3.1 (#2 & 10)

PCS T-Cold Instruments TT-0112CA, Temperature Signal (SPI T Power for PDIL Alarm Circuit) 3.1.6 TT-0112CA & 0122CA, Temperature Signal (C-150) 3.3.8 (#6 & 7)

TT-0122CB, Temperature Signal (PIP T Power for PDIL Alarm Circuit) 3.1.6 TT-0112CA & 0122CB, Temperature Signal (LTOP) 3.4.12.b.1 TT-0112CC & 0122CD (PTR-0112 & 0122) Temperature Indication 3.3.7 (#2)

TT-0112 & 0122 CC & CD, Temperature Signal (SMM) 3.3.7 (#5)

TT-0112 & 0122 CA, CB, CC, & CD, Temperature Signal (Q Power & TMM) 3.3.1 (#1 & 9) & 3.4.1.b PCS T-Hot Instruments TT-0112HA, Temperature Signal (SPI T Power for PDIL Alarm Circuit) 3.1.6 TT-0112HA & 0122HA, Temperature Signal (C-150) 3.3.8 (#4 & 5)

TT-0122HB, Temperature Signal (PIP T Power for PDIL Alarm Circuit) 3.1.6 TT-0112 & 0122 HC & HD, Temperature Signal (SMM) 3.3.7 (#5)

TT-0112HC & 0122HD (PTR-0112 & 0122) Temperature Indication 3.3.7 (#1)

TT-0112 & 0122 HA, HB, HC, & HD, Temperature Signal (Q Power & TMM) 3.3.1 (#1 & 9)

Thermal Margin Monitors PY-0102A, B, C, & D 3.3.1 (#1 & 9)

Pressurizer Pressure Instruments PT-0102A, B, C, & D, Pressure Signal (RPS & SIS) 3.3.1 (#8 & 9) &

3.3.3 (#1.a & 7a)

PT-0104A & B, Pressure Signal (LTOP & SDC Interlock) 3.4.12.b.1 & 3.4.14 PT-0105A & B, Pressure Signal (WR Indication & LTOP) 3.3.7 (#5) & 3.4.12.b.1 PI-0110, Pressure Indication @ C-150 Panel 3.3.8 (#2)

SG Level Instruments LT-0751 & 0752 A, B, C, & D, Level Signal (RPS & AFAS) 3.3.1 (#4 & 5) &

3.3.3 (#4.a & 4.b)

LI-0757 & 0758 A & B, Wide Range Level Indication 3.3.7 (#11 & 12)

LI-0757C & 0758C, Wide Range Level Indication @ C-150 Panel 3.3.8 (#10 & 11)

SG Pressure Instruments PT-0751 & 0752 A, B, C, & D, Pressure Signal (RPS & SG Isolation) 3.3.1 (#6 & 7) &

3.3.3 (#2a, 2b, 7b, 7c)

PT-0751A and PT-0752A Pressure Signal (C-150/150A) 3.3.8 (#8 & 9)

PIC-0751 & 0752 C & D, Pressure Indication 3.3.7 (#13 & 14)

PI-0751E & 0752E, Pressure Indication @ C-150 Panel 3.3.8 (#8 & 9)

Containment Pressure Instruments PS-1801, 1802, 1803, & 1804, Switch Output (RPS) 3.3.1 (#11)

PS-1801, 1802A, 1803, & 1804A, Switch Output (ESF) 3.3.3 (#5.a)

PS-1801A, 1802, 1803A, & 1804, Switch Output (ESF) 3.3.3 (#5.b)

Note: The information provided in this table is intended for use as an aid to distinguish those instrument channels which provide more than one required function and to describe which specifications they affect. The information in this table should not be taken as inclusive for all instruments nor affected specifications.

Palisades Nuclear Plant B 3.3.1-35 Revised 04/14/2011

DG - UV Start B 3.3.5 B 3.3 INSTRUMENTATION B 3.3.5 Diesel Generator (DG) - Undervoltage Start (UV Start)

BASES BACKGROUND The DGs provide a source of emergency power when offsite power is either unavailable or insufficiently stable to allow safe plant operation.

Undervoltage protection will generate a UV Start in the event a Loss of Voltage or Degraded Voltage condition occurs. There are two UV Start Functions for each 2.4 kV vital bus.

Undervoltage protection and load shedding features for safety-related buses at the 2,400 V and lower voltage levels are designed in accordance with 10 CFR 50, Appendix A, General Design Criterion 17 (Ref. 1) and the following features:

1. Two levels of automatic undervoltage protection from loss or degradation of offsite power sources are provided. The first level (loss of voltage) provides normal loss of voltage protection. The second level of protection (degraded voltage) has voltage and time delay set points selected for automatic trip of the offsite sources to protect safety-related equipment from sustained degraded voltage conditions at all bus voltage levels.

Coincidence logic is provided to preclude spurious trips.

2. The undervoltage protection system automatically prevents load shedding of the safety-related buses when the emergency generators are supplying power to the safeguards loads.

3. Control circuits for shedding of Class 1E and non-Class 1E loads during a Loss of Coolant Accident (LOCA) themselves are Class 1E or are separated electrically from the Class 1E portions.

Palisades Nuclear Plant B 3.3.5-1 Revised 04/14/2011

DG - UV Start B 3.3.5 BASES BACKGROUND Description (continued)

Each 2,400 V Bus (1C and 1D) is equipped with two levels of undervoltage protection relays (Ref. 2). The first level (Loss of Voltage Function) relays 127-1 and 127-2 are set at approximately 77% of rated voltage with an inverse time relay. One of these relays measures voltage on each of the three phases. They protect against sudden loss of voltage as sensed on the corresponding bus using a three-out-of-three coincidence logic. The actuation of the associated auxiliary relays will trip the associated bus incoming circuit breakers, start its associated DG, initiate bus load shedding, and activate annunciators in the control room. The DG circuit breaker is closed automatically upon establishment of satisfactory voltage and frequency by the use of associated voltage sensing relay 127D-1 or 127D-2.

The second level of undervoltage protection (Degraded Voltage Function) relays 127-7 and 127-8 are set at approximately 93% of rated voltage, with one relay monitoring each of the three phases. These relays protect against sustained degraded voltage conditions on the corresponding bus using a three-out-of-three coincidence logic. These relays have a built-in 0.65 second time delay, after which the associated DG receives a start signal and annunciators in the control room are actuated. If a bus undervoltage exists after an additional six seconds, the associated bus incoming circuit breakers will be tripped and a bus load shed will be initiated.

Trip Setpoints The trip setpoints are based on the analytical limits presented in References 3 and 4, and justified in Reference 5. The selection of these trip setpoints is such that adequate protection is provided when all sensor and processing time delays are taken into account. To allow for calibration tolerances, instrumentation uncertainties, and instrument drift, setpoints specified in SR 3.3.5.2 are conservatively adjusted with respect to the analytical limits. A detailed analysis of the degraded voltage protection is provided in References 3 and 4.

The specified setpoints will ensure that the consequences of accidents will be acceptable, providing the plant is operated from within the LCOs at the onset of the accident and the equipment functions as designed.

Palisades Nuclear Plant B 3.3.5-2 Revised 04/14/2011

DG - UV Start B 3.3.5 BASES APPLICABLE The DG - UV Start is required for Engineered Safety Features (ESF)

SAFETY ANALYSES systems to function in any accident with a loss of offsite power. Its design basis is that of the ESF Systems.

Accident analyses credit the loading of the DG based on a loss of offsite power during a LOCA. The diesel loading has been included in the delay time associated with each safety system component requiring DG supplied power following a loss of offsite power. This delay time includes contributions from the DG start, DG loading, and Safety Injection System component actuation.

The required channels of UV Start, in conjunction with the ESF systems powered from the DGs, provide plant protection in the event of any of the analyzed accidents discussed in Reference 6, in which a loss of offsite power is assumed. UV Start channels are required to meet the redundancy and testability requirements of GDC 21 in 10 CFR 50, Appendix A (Ref. 1).

The delay times assumed in the safety analysis for the ESF equipment include the 10 second DG start delay and the appropriate sequencing delay, if applicable. The response times for ESFAS actuated equipment include the appropriate DG loading and sequencing delay.

The DG - UV Start channels satisfy Criterion 3 of 10 CFR 50.36(c)(2).

LCO The LCO for the DG - UV Start requires that three channels per bus of each UV Start instrumentation Function be OPERABLE when the associated DG is required to be OPERABLE. The UV Start supports safety systems associated with ESF actuation.

The Bases for the trip setpoints are as follows:

The voltage trip setpoint is set low enough such that spurious trips of the offsite source due to operation of the undervoltage relays are not expected for any combination of plant loads and normal grid voltages.

Palisades Nuclear Plant B 3.3.5-3 Revised 04/14/2011

DG - UV Start B 3.3.5 BASES LCO This setpoint at the 2,400 V bus and reflected down to the 480 V buses (continued) has been verified through an analysis to be greater than the minimum allowable motor voltage (90% of nominal voltage). Motors are the most limiting equipment in the system. MCC contactor pickup and drop-out voltage is also adequate at the setpoint values. The analysis ensures that the distribution system is capable of starting and operating all safety-related equipment within the equipment voltage rating at the allowed source voltages. The power distribution system model used in the analysis has been verified by actual testing (Refs. 5 and 7).

The time delays involved will not cause any thermal damage as the setpoints are within voltage ranges for sustained operation. They are long enough to preclude trip of the offsite source caused by the starting of large motors and yet do not exceed the time limits of ESF actuation assumed in FSAR Chapter 14 (Ref. 6) and validated by Reference 8.

Calibration of the undervoltage relays verify that the time delay is sufficient to avoid spurious trips.

APPLICABILITY The DG - UV Start actuation Function is required to be OPERABLE whenever the associated DG is required to be OPERABLE per LCO 3.8.1, AC Sources - Operating, or LCO 3.8.2, AC Sources -

Shutdown, so that it can perform its function on a loss of power or degraded power to the vital bus.

ACTIONS A DG - UV Start channel is inoperable when it does not satisfy the OPERABILITY criteria for the channel's Function.

In the event a channel's trip setpoint is found nonconservative with respect to the specified setpoint, or the channel is found inoperable, then all affected Functions provided by that channel must be declared inoperable and the LCO Condition entered. The required channels are specified on a per DG basis.

Palisades Nuclear Plant B 3.3.5-4 Revised 04/14/2011

DG - UV Start B 3.3.5 BASES ACTIONS A.1 (continued)

Condition A applies if one or more of the three phase UV sensors or relay logic is inoperable for one or more Functions (Degraded Voltage or Loss of Voltage) per DG bus.

The affected DG must be declared inoperable and the appropriate Condition(s) entered. Because of the three-out-of-three logic in both the Loss of Voltage and Degraded Voltage Functions, the appropriate means of addressing channel failure is declaring the DG inoperable, and effecting repair in a manner consistent with other DG failures.

Required Action A.1 ensures that Required Actions for the affected DG inoperabilities are initiated. Depending upon plant MODE, the actions specified in LCO 3.8.1 or LCO 3.8.2, as applicable, are required immediately.

SURVEILLANCE SR 3.3.5.1 REQUIREMENTS A CHANNEL FUNCTIONAL TEST is performed on each UV Start logic channel every 18 months to ensure that the logic channel will perform its intended function when needed. The Undervoltage sensing relays are tested by SR 3.3.5.2. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.

The Frequency of 18 months is based on the plant conditions necessary to perform the test.

Palisades Nuclear Plant B 3.3.5-5 Revised 04/14/2011

DG - UV Start B 3.3.5 BASES SURVEILLANCE SR 3.3.5.2 REQUIREMENTS (continued) A CHANNEL CALIBRATION performed each 18 months verifies the accuracy of each component within the instrument channel. This includes calibration of the undervoltage relays and demonstrates that the equipment falls within the specified operating characteristics defined by the manufacturer.

The Surveillance verifies that the channel responds to a measured parameter within the necessary range and accuracy.

CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drift between successive calibrations to ensure that the channel remains operational between successive tests. CHANNEL CALIBRATIONS must be performed consistent with the setpoint analysis.

The Frequency of 18 months is a typical refueling cycle. Operating experience has shown this Frequency is acceptable.

REFERENCES 1. 10 CFR 50, Appendix A GDCs 17 and 21

2. FSAR, Section 8.6

3. CPCo Analysis EA-ELEC-VOLT-033

4. CPCo Analysis EA-ELEC-VOLT-034

5. Analysis EA-ELEC-EDSA-04

6. FSAR, Chapter 14

7. Analysis EA-ELEC-EDSA-03

8. CPCo Analysis A-NL-92-111 Palisades Nuclear Plant B 3.3.5-6 Revised 04/14/2011

LTOP System B 3.4.12 B 3.4 PRIMARY COOLANT SYSTEM (PCS)

B 3.4.12 Low Temperature Overpressure Protection (LTOP) System BASES BACKGROUND The LTOP System controls PCS pressure at low temperatures so the integrity of the Primary Coolant Pressure Boundary (PCPB) is not compromised by violating the Pressure and Temperature (P/T) limits of 10 CFR 50, Appendix G (Ref. 1). The reactor vessel is the limiting PCPB component requiring such protection. LCO 3.4.3, "PCS Pressure and Temperature (P/T) Limits," provides the allowable combinations for operational pressure and temperature during cooldown, shutdown, and heatup to keep from violating the Reference 1 requirements during the LTOP MODES.

The toughness of the reactor vessel material decreases at low temperatures. As the vessel neutron exposure accumulates, the material toughness decreases and becomes less resistant to pressure stress at low temperatures (Ref. 2). PCS pressure, therefore, is maintained low at low temperatures and is increased only as temperature is increased.

The potential for vessel overpressurization is most acute when the PCS is water solid, which occurs only while shutdown. Under that condition, a pressure fluctuation can occur more quickly than an operator can react to relieve the condition. Exceeding the PCS P/T limits by a significant amount could cause brittle fracture of the reactor vessel. LCO 3.4.3 requires administrative control of PCS pressure and temperature during heatup and cooldown to prevent exceeding the P/T limits.

This LCO provides PCS overpressure protection by limiting coolant injection capability and requiring adequate pressure relief capacity.

Limiting coolant injection capability requires all High Pressure Safety Injection (HPSI) pumps be incapable of injection into the PCS when any PCS cold leg temperature is < 300°F. The pressure relief capacity requires either two OPERABLE redundant Power Operated Relief Valves (PORVs) or the PCS depressurized and a PCS vent of sufficient size.

One PORV or the PCS vent is the overpressure protection device that acts to terminate an increasing pressure event.

Palisades Nuclear Plant B 3.4.12-1 Revised 04/14/2011

LTOP System B 3.4.12 BASES BACKGROUND With limited coolant injection capability, the ability to provide core (continued) coolant addition is restricted. The LCO does not require the chemical and volume control system to be deactivated or the Safety Injection Signals (SIS) blocked. Due to the lower pressures in the LTOP MODES and the expected core decay heat levels, the chemical and volume control system can provide adequate flow via the makeup control valve. If conditions require the use of an HPSI pump for makeup in the event of loss of inventory, then a pump can be made available through manual actions.

The LTOP System for pressure relief consists of two PORVs with temperature dependent lift settings or a PCS vent of sufficient size.

Two PORVs are required for redundancy. One PORV has adequate relieving capability to prevent overpressurization for the allowed coolant injection capability.

PORV Requirements As designed for the LTOP System, an open signal is generated for each PORV if the PCS pressure approaches a limit determined by the LTOP actuation logic. The actuation logic monitors PCS pressure and cold leg temperature to determine when the LTOP overpressure setting is approached. If the indicated pressure meets or exceeds the calculated value, a PORV is opened.

The LCO presents the PORV setpoints for LTOP by specifying Figure 3.4.12-1, LTOP Setpoint Limit. Having the setpoints of both valves within the limits of the LCO ensures the P/T limits will not be exceeded in any analyzed event.

When a PORV is opened in an increasing pressure transient, the release of coolant causes the pressure increase to slow and reverse. As the PORV releases coolant, the system pressure decreases until a reset pressure is reached and the valve closed. The pressure continues to decrease below the reset pressure as the valve closes.

Palisades Nuclear Plant B 3.4.12-2 Revised 04/14/2011

LTOP System B 3.4.12 BASES BACKGROUND PCS Vent Requirements (continued)

Once the PCS is depressurized, a vent exposed to the containment atmosphere will maintain the PCS at containment ambient pressure in an PCS overpressure transient if the relieving requirements of the transient do not exceed the capabilities of the vent. Thus, the vent path must be capable of relieving the flow resulting from the limiting LTOP mass injection or heatup transient and maintaining pressure below the P/T limits. The required vent capacity may be provided by one or more vent paths.

Reference 3 has determined that any vent path capable of relieving 167 gpm at a PCS pressure of 315 psia is acceptable. The 167 gpm flow rate is based on an assumed charging imbalance due to interruption of letdown flow with three charging pumps operating, a 40°F per hour PCS heatup rate, a 60°F per hour pressurizer heatup rate, and an initially depressurized and vented PCS. Neither HPSI pump nor Primary Coolant Pump (PCP) starts need to be assumed with the PCS initially depressurized, because LCO 3.4.12 requires both HPSI pumps to be incapable of injection into the PCS and LCO 3.4.7, PCS Loops-MODE 5, Loops Filled, places restrictions on starting a PCP.

The pressure relieving ability of a vent path depends not only upon the area of the vent opening, but also upon the configuration of the piping connecting the vent opening to the PCS. A long, or restrictive piping connection may prevent a larger vent opening from providing adequate flow, while a smaller opening immediately adjacent to the PCS could be adequate. The areas of multiple vent paths cannot simply be added to determine the necessary vent area.

The following vent path examples are acceptable:

1. Removal of a steam generator primary manway;

2. Removal of the pressurizer manway;

3. Removal of a PORV or pressurizer safety valve;

4. Both PORVs and associated block valves open; and

5. Opening of both PCS vent valves MV-PC514 and MV-PC515.

Palisades Nuclear Plant B 3.4.12-3 Revised 04/14/2011

LTOP System B 3.4.12 BASES BACKGROUND Reference 4 determined that venting the PCS through MV-PC514 and (continued) MV-PC515 provided adequate flow area. The other listed examples provide greater flow areas with less piping restriction and are therefore acceptable. Other vent paths shown to provide adequate capacity could also be used. The vent path(s) must be above the level of reactor coolant, to prevent draining the PCS.

One open PORV provides sufficient flow area to prevent excessive PCS pressure. However, if the PORVs are elected as the vent path, both valves must be used to meet the single failure criterion, since the PORVs are held open against spring pressure by energizing the operating solenoid.

When the shutdown cooling system is in service with MO-3015 and MO-3016 open, additional overpressure protection is provided by the relief valves on the shutdown cooling system. References 5 and 6 show that this relief capacity will prevent the PCS pressure from exceeding its pressure limits during any of the above mentioned events.

APPLICABLE Safety analyses (Ref. 7) demonstrate that the reactor vessel is SAFETY ANALYSES adequately protected against exceeding the Reference 1 P/T limits during shutdown. In MODES 1 and 2, and in MODE 3 with all PCS cold leg temperature at or exceeding 430°F, the pressurizer safety valves prevent PCS pressure from exceeding the Reference 1 limits. Below 430°F, overpressure prevention falls to the OPERABLE PORVs or to a depressurized PCS and a sufficiently sized PCS vent. Each of these means has a limited overpressure relief capability.

The actual temperature at which the pressure in the P/T limit curve falls below the pressurizer safety valve setpoint increases as the reactor vessel material toughness decreases due to neutron embrittlement. Each time the P/T limit curves are revised, the LTOP System should be re-evaluated to ensure its functional requirements can still be satisfied using the PORV method or the depressurized and vented PCS condition.

Reference 3 contains the acceptance limits that satisfy the LTOP requirements. Any change to the PCS must be evaluated against these analyses to determine the impact of the change on the LTOP acceptance limits.

Palisades Nuclear Plant B 3.4.12-4 Revised 04/14/2011

LTOP System B 3.4.12 BASES APPLICABLE Transients that are capable of overpressurizing the PCS are SAFETY ANALYSES categorized as either mass injection or heatup transients (continued)

Mass Injection Type Transients

a. Inadvertent safety injection; or

b. Charging/letdown flow mismatch.

Heatup Type Transients

a. Inadvertent actuation of pressurizer heaters;

b. Loss of Shutdown Cooling (SDC); or

c. PCP startup with temperature asymmetry within the PCS or between the PCS and steam generators.

Rendering both HPSI pumps incapable of injection is required during the LTOP MODES to ensure that mass injection transients beyond the capability of the LTOP overpressure protection system, do not occur. The Reference 3 analyses demonstrate that either one PORV or the PCS vent can maintain PCS pressure below limits when three charging pump are actuated. Thus, the LCO prohibits the operation of both HPSI pumps and does not place any restrictions on charging pump operation.

Fracture mechanics analyses were used to establish the applicable temperature range for the LTOP LCO as below 430°F. At and above this temperature, the pressurizer safety valves provide the reactor vessel pressure protection. The pressure-temperature limit curves and LTOP curve are based on reactor vessel material properties which change over time due to radiation embrittlement. These curves are valid for the period of time corresponding to the reactor vessel material condition which was assumed when the curves were generated. At the time the curves were developed, they were based on being valid up to a neutron irradiation accumulation equal to 2.192 x 1019 n (neutrons)/cm2 (Ref. 3). An evaluation has determined that the curves are valid up to a greater neutron irradiation accumulation of 2.246 x 1019 n/cm2, which is estimated to be reached March, 2012 (Ref. 9).

Palisades Nuclear Plant B 3.4.12-5 Revised 04/14/2011

LTOP System B 3.4.12 BASES APPLICABLE PORV Performance SAFETY ANALYSES (continued) The fracture mechanics analyses show that the vessel is protected when the PORVs are set to open at or below the setpoint curve specified in Figure 3.4.12-1 of the accompanying LCO. The setpoint is derived by modeling the performance of the LTOP System, assuming the limiting allowed LTOP transient. The valve qualification process considered pressure overshoot and undershoot beyond the PORV opening and closing setpoints, resulting from signal processing and valve stroke times.

The PORV setpoints at or below the derived limit ensure the Reference 1 limits will be met.

The PORV setpoints will be re-evaluated for compliance when the P/T limits are revised. The P/T limits are periodically modified as the reactor vessel material toughness decreases due to embrittlement caused by neutron irradiation. Revised P/T limits are determined using neutron fluence projections and the results of examinations of the reactor vessel material irradiation surveillance specimens. The Bases for LCO 3.4.3 discuss these examinations.

The PORVs are considered active components. Thus, the failure of one PORV represents the worst case, single active failure.

PCS Vent Performance With the PCS depressurized, analyses show the required vent size is capable of mitigating the limiting allowed LTOP overpressure transient. In that event, this size vent maintains PCS pressure less than the maximum PCS pressure on the P/T limit curve.

The PCS vent is passive and is not subject to active failure.

LTOP System satisfies Criterion 2 of 10 CFR 50.36(c)(2).

Palisades Nuclear Plant B 3.4.12-6 Revised 04/14/2011

LTOP System B 3.4.12 BASES LCO This LCO is required to ensure that the LTOP System is OPERABLE.

The LTOP System is OPERABLE when both HPSI pumps are incapable of injecting into the PCS and pressure relief capabilities are OPERABLE.

Violation of this LCO could lead to the loss of low temperature overpressure mitigation and violation of the Reference 1 limits as a result of an operational transient.

To limit the coolant injection capability, LCO 3.4.12.a requires both HPSI pumps be incapable of injecting into the PCS. LCO 3.4.12.a is modified by two Notes. Note 1 only requires both HPSI pumps to be incapable of injecting into the PCS when any PCS cold leg temperature is < 300°F.

When all PCS cold leg temperatures are ³ 300°F, a start of both HPSI pumps in conjunction with a charging/letdown imbalance will not cause the PCS pressure to exceed the 10 CFR 50 Appendix G limits. Thus, a restriction on HPSI pump operation when all PCS cold leg temperatures are ³ 300°F is not required. Note 2 is provided to assure that this LCO does not cause hesitation in the use of a HPSI pump for PCS makeup if it is needed due to a loss of shutdown cooling or a loss of PCS inventory.

The elements of the LCO that provide overpressure mitigation through pressure relief are:

a. Two OPERABLE PORVs; or

b. The PCS depressurized and vented.

A PORV is OPERABLE for LTOP when its block valve is open, its lift setpoint is set consistent with Figure 3.4.12-1 in the accompanying LCO and testing has proven its ability to open at that setpoint, and motive power is available to the valve and its control circuit.

A PCS vent is OPERABLE when open with an area capable of relieving

³ 167 gpm at a PCS pressure of 315 psia.

Each of these methods of overpressure prevention is capable of mitigating the limiting LTOP transient.

Palisades Nuclear Plant B 3.4.12-7 Revised 04/14/2011

LTOP System B 3.4.12 BASES APPLICABILITY This LCO is applicable in MODE 3 when the temperature of any PCS cold leg is < 430°F, in MODES 4 and 5, and in MODE 6 when the reactor vessel head is on. The pressurizer safety valves provide overpressure protection that meets the Reference 1 P/T limits at and above 430°F.

When the reactor vessel head is off, overpressurization cannot occur.

LCO 3.4.3 provides the operational P/T limits for all MODES.

LCO 3.4.10, "Pressurizer Safety Valves," requires the OPERABILITY of the pressurizer safety valves that provide overpressure protection during MODES 1 and 2, and MODE 3 with all PCS cold leg temperatures

³ 430°F.

Low temperature overpressure prevention is most critical during shutdown when the PCS is water solid, and a mass addition or a heatup transient can cause a very rapid increase in PCS pressure with little or no time available for operator action to mitigate the event.

ACTIONS A Note prohibits the application of LCO 3.0.4.b to inoperable PORVs used for LTOP. There is an increased risk associated with entering MODE 4 from MODE 5 with PORVs used for LTOP inoperable and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.

A.1 With one or two HPSI pumps capable of injecting into the PCS, overpressurization is possible.

The immediate Completion Time to initiate actions to restore restricted coolant injection capability to the PCS reflects the importance of maintaining overpressure protection of the PCS.

Palisades Nuclear Plant B 3.4.12-8 Revised 04/14/2011

LTOP System B 3.4.12 BASES ACTIONS B.1 (continued)

With one required PORV inoperable and pressurizer water level £ 57%,

the required PORV must be restored to OPERABLE status within a Completion Time of 7 days. Two valves are required to meet the LCO requirement and to provide low temperature overpressure mitigation while withstanding a single failure of an active component.

The Completion Time is based on only one PORV being required to mitigate an overpressure transient, the likelihood of an active failure of the remaining valve path during this time period being very low, and that a steam bubble exists in the pressurizer. Since the pressure response to a transient is greater if the pressurizer steam space is small or if the PCS is solid, the Completion Time for restoration of a PORV flow path to service is shorter. The maximum pressurizer level at which credit can be taken for having a bubble (57%, which provides about 700 cubic feet of steam space) is based on judgment rather than by analysis. This level provides the same steam volume to dampen pressure transients as would be available at full power. This steam volume provides time for operator action (if the PORVs failed to operate) in the interval between an inadvertent SIS and PCS pressure reaching the 10 CFR 50, Appendix G pressure limit. The time available for action would depend upon the existing pressure and temperature when the inadvertent SIS occurred.

C.1 The consequences of operational events that will overpressurize the PCS are more severe at lower temperature (Ref. 8). With the pressurizer water level > 57%, less steam volume is available to dampen pressure increases resulting from an inadvertent mass injection or heatup transients. Thus, with one required PORV inoperable and the pressurizer water level > 57%, the Completion Time to restore the required PORV to OPERABLE status is 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time to restore the required PORV to OPERABLE status when the pressurizer water level is > 57%, which usually occurs in MODE 5 or in MODE 6 when the vessel head is on, is a reasonable amount of time to investigate and repair PORV failures without a lengthy period with only one PORV OPERABLE to protect against overpressure events.

Palisades Nuclear Plant B 3.4.12-9 Revised 04/14/2011

LTOP System B 3.4.12 BASES ACTIONS D.1 (continued)

If two required PORVs are inoperable, or if the Required Actions and the associated Completion Times are not met, or if the LTOP System is inoperable for any reason other than Condition A, B, or C, the PCS must be depressurized and a vent established within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . The vent must be sized to provide a relieving capability of ³ 167 gpm at a pressure of 315 psia which ensures the flow capacity is greater than that required for the worst case mass injection transient reasonable during the applicable MODES. This action protects the PCPB from a low temperature overpressure event and a possible brittle failure of the reactor vessel.

The Completion Time of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months to depressurize and vent the PCS is based on the time required to place the plant in this condition and the relatively low probability of an overpressure event during this time period due to operator attention and administrative requirements.

SURVEILLANCE SR 3.4.12.1 REQUIREMENTS To minimize the potential for a low temperature overpressure event by limiting the mass injection capability, both HPSI pumps are verified to be incapable of injecting into the PCS. The HPSI pumps are rendered incapable of injecting into the PCS by means that assure that a single event cannot cause overpressurization of the PCS due to operation of the pump. Typical methods for accomplishing this are by pulling the HPSI pump breaker control power fuses, racking out the HPSI pump motor circuit breaker, or closing the manual discharge valve.

SR 3.4.12.1 is modified by a Note which only requires the SR to be met when complying with LCO 3.4.12.a. When all PCS cold leg temperature are ³ 300°F, a start of both HPSI pumps in conjunction with a charging/letdown imbalance will not cause the PCS pressure to exceed the 10 CFR 50 Appendix G limits. Thus, this SR is only required when any PCS cold leg temperature is reduced to less than 300°F.

The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months interval considers operating practice to regularly assess potential degradation and to verify operation within the safety analysis.

Palisades Nuclear Plant B 3.4.12-10 Revised 04/14/2011

LTOP System B 3.4.12 BASES SURVEILLANCE SR 3.4.12.2 REQUIREMENTS (continued) SR 3.4.12.2 requires a verification that the required PCS vent, capable of relieving ³ 167 gpm at a PCS pressure of 315 psia, is OPERABLE by verifying its open condition either:

a. Once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for a valve that is not locked open; or

b. Once every 31 days for a valve that is locked open.

The passive vent arrangement must only be open to be OPERABLE.

This Surveillance need only be performed if vent valves are being used to satisfy the requirements of this LCO. This Surveillance does not need to be performed for vent paths relying on the removal of a steam generator primary manway cover, pressurizer manway cover, safety valve or PORV since their position is adequately addressed using administrative controls and the inadvertent reinstallation of these components is unlikely. The Frequencies consider operating experience with mispositioning of unlocked and locked vent valves, respectively.

SR 3.4.12.3 The PORV block valve must be verified open every 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to provide the flow path for each required PORV to perform its function when actuated. The valve can be remotely verified open in the main control room.

The block valve is a remotely controlled, motor operated valve. The power to the valve motor operator is not required to be removed, and the manual actuator is not required locked in the inactive position. Thus, the block valve can be closed in the event the PORV develops excessive leakage or does not close (sticks open) after relieving an overpressure event.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Frequency considers operating experience with accidental movement of valves having remote control and position indication capabilities available where easily monitored. These considerations include the administrative controls over main control room access and equipment control.

Palisades Nuclear Plant B 3.4.12-11 Revised 04/14/2011

LTOP System B 3.4.12 BASES SURVEILLANCE SR 3.4.12.4 REQUIREMENTS (continued) Performance of a CHANNEL FUNCTIONAL TEST is required every 31 days. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay This is acceptable because all of the Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. PORV actuation could depressurize the PCS and is not required. The 31 day Frequency considers experience with equipment reliability.

A Note has been added indicating this SR is required to be performed 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after decreasing any PCS cold leg temperature to < 430°F. This Note allows a discrete period of time to perform the required test without delaying entry into the MODE of Applicability for LTOP. This option may be exercised in cases where an unplanned shutdown below 430°F is necessary as a result of a Required Action specifying a plant shutdown, or other plant evolutions requiring an expedited cooldown of the plant.

The test must be performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after entering the LTOP MODES.

SR 3.4.12.5 Performance of a CHANNEL CALIBRATION on each required PORV actuation channel is required every 18 months to adjust the entire channel so that it responds and the valve opens within the required LTOP range and with accuracy to known input.

The 18 month Frequency considers operating experience with equipment reliability and is consistent with the typical refueling outage schedule.

Palisades Nuclear Plant B 3.4.12-12 Revised 04/14/2011

LTOP System B 3.4.12 BASES REFERENCES 1. 10 CFR 50, Appendix G

2. Generic Letter 88-11

3. CPC Engineering Analysis, EA-A-PAL-92-095-01

4. CPC Engineering Analysis, EA-TCD-90-01

5. CPC Engineering Analysis, EA-E-PAL-89-040-1

6. CPC Corrective Action Document, A-PAL-91-011

7. FSAR, Section 7.4

8. Generic Letter 90-06

9. Palisades Engineering Report PLP-RPT-2010-00059 Palisades Nuclear Plant B 3.4.12-13 Revised 04/14/2011

Containment Isolation Valves B 3.6.3 B 3.6 CONTAINMENT SYSTEMS B 3.6.3 Containment Isolation Valves BASES BACKGROUND The containment isolation valves and devices form part of the containment pressure boundary and provide a means for isolating penetration flow paths. These isolation devices are either passive or active (automatic). Manual valves, de-activated automatic valves secured in their closed position (including check valves with flow through the valve secured) and blind flanges are considered passive devices. Check valves, or other automatic valves designed to close without operator action following an accident, are considered active devices. Two barriers in series are provided for each penetration so that no single credible failure or malfunction of an active component can result in a loss of isolation or leakage that exceeds limits assumed in the safety analysis.

One of these barriers may be a closed system.

The Containment Isolation System is designed to provide isolation capability following a Design Basis Accident (DBA) for fluid lines that penetrate containment. Major nonessential lines (i.e., fluid systems that do not perform an immediate accident mitigation function) that penetrate containment, except for the main steam lines and instrument air line, are either automatically isolated following an accident or are normally maintained closed in MODES 1, 2, 3, and 4. Containment isolation occurs upon receipt of a Containment High Pressure (CHP) signal or a Containment High Radiation (CHR) signal. However, not all containment isolation valves are actuated by both signals. The signals close automatic containment isolation valves in fluid penetrations that are required to be isolated during accident conditions in order to minimize release of fission products from the Primary Coolant System (PCS) to the environment. Other penetrations that are required to be isolated during accident conditions are isolated by the use of valves or check valves in the closed position, or blind flanges. As a result, the containment isolation devices help ensure that the containment atmosphere will be isolated in the event of a release of fission products to the containment atmosphere from the PCS following a DBA.

Palisades Nuclear Plant B 3.6.3-1 Revised 04/14/2011

Containment Isolation Valves B 3.6.3 BASES BACKGROUND The plant safety analyses (Reference 5) assume containment isolation for the mitigation of a Loss of Coolant Accident (LOCA) and a control rod ejection accident. The Main Steam Line Break, Steam Generator Tube Rupture, and Control Rod Ejection accident analyses include scenarios in which the mass of steam from the Steam Generator is assumed to be released directly to the environment, and no credit is taken for containment isolation to mitigate the radiological consequences of those accidents. For other analyzed accidents, a release path via fluid lines connected directly to the secondary side of the steam generators would require a passive failure, and Palisades is not required to postulate passive failures of equipment performing safety functions in accident scenarios (Reference 6). Therefore, valves in fluid lines connected directly to the secondary side of the steam generators are not included in this Technical Specification.

The OPERABILITY requirements for containment isolation valves and devices help ensure that containment is isolated within the time limits assumed in the safety analyses. Therefore, the OPERABILITY requirements provide assurance that the containment leakage limits assumed in the accident analyses will not be exceeded in a DBA.

The 8 inch purge exhaust valves are designed for purging the containment atmosphere to the stack while introducing filtered makeup, through the 12 inch air room supply valves from the outside, when the plant is shut down during refueling operations and maintenance. The purge exhaust valves and air room supply valves are air operated isolation valves located outside the containment. These valves are operated manually from the control room. These valves will close automatically upon receipt of a CHP or CHR signal. The air operated valves fail closed upon a loss of air. These valves are not qualified for automatic closure from their open position under DBA conditions.

Therefore, these valves are locked closed in MODES 1, 2, 3, and 4 to ensure the containment boundary is maintained.

Open purge exhaust or air room supply valves, following an accident that releases contamination to the containment atmosphere, would cause a significant increase in the containment leakage rate.

APPLICABLE The containment isolation valve LCO was derived from the assumptions SAFETY ANALYSES related to minimizing the release of fission products from the primary coolant system to the environment, and establishing the containment boundary during major accidents. As part of the containment boundary, containment isolation valve (device) OPERABILITY supports leak tightness of the containment. Therefore, the safety analysis of any event requiring isolation of containment is applicable to this LCO.

Palisades Nuclear Plant B 3.6.3-2 Revised 04/14/2011

Containment Isolation Valves B 3.6.3 BASES APPLICABLE A Loss of Coolant Accident (LOCA) and a control rod ejection accident SAFETY ANALYSES are the two DBAs that require isolation of containment to minimize (continued) release of fission products to the environment (Ref. 5). In the analysis for each of these accidents, it is assumed that containment isolation devices that are required to be closed during accident conditions are either closed or function to close within the required isolation time following event initiation. This ensures that potential paths to the environment through containment isolation devices (including containment purge valves) are minimized. The safety analysis assumes that the purge exhaust and air room supply valves are closed at event initiation.

The DBA analysis assumes that, within 25 seconds after receiving a CHP or CHR signal each automatic power operated valve is closed and containment leakage terminated except for the design leakage rate .

The single failure criterion required to be imposed in the conduct of plant safety analyses was considered in the design of the containment purge valves. Two valves in series on each line provide assurance that both the supply and exhaust lines could be isolated even if a single failure occurred. Both isolation valves on the 8 inch and 12 inch lines are pneumatically operated spring-closed valves.

The 8 inch purge exhaust and 12 inch air room supply valves may be unable to close in the environment following a LOCA. Therefore, each of the purge valves is required to remain locked closed during MODES 1, 2, 3, and 4. In this case, the single failure criterion remains applicable to the containment purge valves due to the potential for failure in the control circuit associated with each valve. Again, the purge system valve design precludes a single failure from compromising the containment boundary as long as the system is operated in accordance with the subject LCO.

The containment isolation valves satisfy Criterion 3 of 10 CFR 50.36(c)(2).

LCO Containment isolation valves form a part of the containment boundary.

Compliance with this LCO will ensure a containment configuration that will limit leakage to those leakage rates assumed in the safety analyses.

Containment penetrations for fluid systems that perform an accident mitigation function are not required to be isolated.

Palisades Nuclear Plant B 3.6.3-3 Revised 04/14/2011

Containment Isolation Valves B 3.6.3 BASES LCO Containment isolation valves (devices) consist of isolation valves (manual (continued) valves, check valves, air operated valves, and motor operated valves),

and blind flanges. There are two major categories of containment isolation devices that are used depending on the type of penetration and the function of the associated piping system:

a. Active - automatic containment isolation devices that, following an accident, either receive a containment isolation signal to close, or close as a result of differential pressure;

b. Passive - normally closed containment isolation devices that are maintained closed in MODES 1, 2, 3, and 4 since they do not receive a containment isolation signal to close and the penetration is not used for normal power operation.

The automatic power operated isolation valves are required to have isolation times within limits and to actuate upon receipt of a CHP or CHR signal as appropriate. Check valves are verified to be OPERABLE through the valve Inservice Testing Program. The purge exhaust and air room supply valves must be locked closed.

The normally closed isolation devices are considered OPERABLE when manual valves are closed, automatic valves are de-activated and secured in their closed position, check valves are closed with flow secured through the pipe, or blind flanges are in place.

The devices covered by this LCO are listed in the FSAR (Ref. 2).

The purge exhaust and air room supply valves with resilient seals must meet the same leakage rate testing requirements as other Type C tested containment isolation valves addressed by LCO 3.6.1, "Containment."

This LCO provides assurance that the containment isolation devices will perform their designed safety functions to minimize the release of fission products from the primary coolant system to the environment and establish the containment boundary during accidents.

Palisades Nuclear Plant B 3.6.3-4 Revised 04/14/2011

Containment Isolation Valves B 3.6.3 BASES APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of fission products to containment. In MODES 5 and 6, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, the containment isolation valves are not required to be OPERABLE in MODE 5. The requirements for containment isolation valves during MODE 6 are addressed in LCO 3.9.3, "Containment Penetrations."

ACTIONS The ACTIONS are modified by four notes. Note 1 allows isolated penetration flow paths, except for 8 inch exhaust and 12 inch air room supply purge valve penetration flow paths, to be unisolated intermittently under administrative controls. These administrative controls consist of stationing a dedicated operator at the device controls, who is in continuous communication with the control room. In this way, the penetration can be rapidly isolated when a need for containment isolation is indicated. Due to the fact that the 8 inch purge exhaust valves and the 12 inch air room supply valves may be unable to close in the environment following a LOCA and the fact that those penetrations exhaust directly from the containment atmosphere to the environment, these valves may not be opened under administrative controls.

Note 2 provides clarification that, for this LCO, separate Condition entry is allowed for each penetration flow path. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable containment isolation device. Complying with the Required Actions may allow for continued operation, and subsequent inoperable containment isolation devices are governed by subsequent Condition entry and application of associated Required Actions.

Note 3 ensures that appropriate remedial actions are taken, if necessary, if the affected systems are rendered inoperable by an inoperable containment isolation device.

Note 4 requires entry into the applicable Conditions and Required Actions of LCO 3.6.1 when leakage results in exceeding the overall containment leakage limit.

A.1 and A.2 Condition A has been modified by a Note indicating that this Condition is only applicable to those penetration flow paths with two containment isolation valves. For penetration flow paths with only one containment isolation valve and a closed system, Condition C provides appropriate actions.

Palisades Nuclear Plant B 3.6.3-5 Revised 04/14/2011

Containment Isolation Valves B 3.6.3 BASES ACTIONS A.1 and A.2 (continued)

In the event one containment isolation valve in one or more penetration flow paths is inoperable (except for purge exhaust or air room supply valves), the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation device that cannot be adversely affected by a single active failure. Isolation devices that meet this criterion are a closed and de-activated automatic containment isolation valve, a closed manual valve, a blind flange, and a check valve with flow through the valve secured. For penetrations isolated in accordance with Required Action A.1, the device used to isolate the penetration should be the closest available one to containment. Required Action A.1 must be completed within the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is reasonable, considering the time required to isolate the penetration and the relative importance of supporting containment OPERABILITY during MODES 1, 2, 3, and 4.

For affected penetration flow paths that cannot be restored to OPERABLE status within the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time and that have been isolated in accordance with Required Action A.1, the affected penetration flow paths must be verified to be isolated on a periodic basis. This is necessary to ensure that containment penetrations required to be isolated following an accident and no longer capable of being automatically isolated will be in the isolation position should an event occur. This Required Action does not require any testing or device manipulation.

Rather, it involves verification that those isolation devices outside containment and capable of being mispositioned are in the correct position. The Completion Time of "once per 31 days for isolation devices outside containment" is appropriate considering the fact that the devices are operated under administrative controls and the probability of their misalignment is low.

For the isolation devices inside containment, the time period specified as "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of the inaccessibility of the isolation devices and other administrative controls that will ensure that isolation device misalignment is an unlikely possibility.

Required Action A.2 is modified by a Note that applies to isolation devices located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of these devices, once they have been verified to be in the proper position, is small.

Palisades Nuclear Plant B 3.6.3-6 Revised 04/14/2011

Containment Isolation Valves B 3.6.3 BASES ACTIONS A.1 and A.2 (continued)

The Completion Time of once per 31 days for verifying each affected penetration flow path outside the containment is isolated is appropriate considering that the penetration can be isolated by the remaining isolable device. As stated in SR 3.02, the 25% extension does not apply to the initial performance of a Required Action with a periodic Completion Time that requires performance on a once per. . . basis. The 25% extension applies to each performance of the Required Action after the initial performance. Therefore, for devices outside the containment, while Required Action 3.6.3 A.2 must be initially performed within 31 days without any SR 3.0.2 extension, subsequent performances may utilize the 25% SR 3.0.2 extension.

B.1 With two containment isolation valves in one or more penetration flow paths inoperable (except for purge exhaust valve or air room supply valve not locked closed), the affected penetration flow path must be isolated within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The method of isolation must include the use of at least one isolation device that cannot be adversely affected by a single active failure. Isolation devices that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is consistent with the ACTIONS of LCO 3.6.1.

In the event the affected penetration is isolated in accordance with Required Action B.1, the affected penetration must be verified to be isolated on a periodic basis per Required Action A.2, which remains in effect. This periodic verification is necessary to assure leak tightness of containment and that penetrations requiring isolation following an accident are isolated.

The Completion Time of once per 31 days for verifying each affected penetration flow path is isolated is appropriate considering the fact that the devices are operated under administrative controls and the probability of their misalignment is low.

Condition B is modified by a Note indicating this Condition is only applicable to penetration flow paths with two containment isolation valves.

Condition A of this LCO addresses the condition of one containment isolation valve inoperable in this type of penetration flow path.

Palisades Nuclear Plant B 3.6.3-7 Revised 04/14/2011

Containment Isolation Valves B 3.6.3 BASES ACTIONS C.1 and C.2 (continued)

Condition C is modified by a Note indicating that this Condition is only applicable to those penetration flow paths with only one containment isolation valve and a closed system. The closed system must meet the requirements of Reference 2. This Note is necessary since this Condition is written to specifically address those penetration flow paths in a closed system.

With one or more penetration flow paths with one containment isolation valve inoperable, the inoperable valve must be restored to OPERABLE status or the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation device that cannot be adversely affected by a single active failure. Isolation devices that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange. A check valve may not be used to isolate the affected penetration. Required Action C.1 must be completed within the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time. The specified time period is reasonable, considering the relative stability of the closed system (hence, reliability) to act as a penetration isolation barrier and the relative importance of supporting containment OPERABILITY during MODES 1, 2, 3, and 4. In the event the affected penetration is isolated in accordance with Required Action C.1, the affected penetration flow path must be verified to be isolated on a periodic basis. This is necessary to assure leak tightness of containment and that containment penetrations requiring isolation following an accident are isolated. This Required Action does not require any testing or device manipulation. Rather, it involves verification that those isolation devices outside containment and capable of being mispositioned are in the correct position.

The Completion Time of once per 31 days for verifying that each affected penetration flow path is isolated is appropriate considering the devices are operated under administrative controls and the probability of their misalignment is low. As stated in SR 3.0.2, the 25% extension allowed by SR 3.0.2 may be applied to Required Actions whose Completion Time is stated as once per. . . however, the 25% extension does not apply to the initial performance on a once per. . . basis. The 25% extension applies to each performance of the Required Action after the initial performance.

Therefore, while Required Action 3.6.3 C.2 must be initially performed within 31 days without any SR 3.0.2 extension, subsequent performances may utilize the 25% SR 3.0.2 extension.

Palisades Nuclear Plant B 3.6.3-8 Revised 04/14/2011

Containment Isolation Valves B 3.6.3 BASES ACTIONS C.1 and C.2 (continued)

Required Action C.2 is modified by a Note that applies to isolation devices located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of these devices, once they have been verified to be in the proper position, is small.

D.1 The purge exhaust and air room supply isolation valves have not been qualified to close following a LOCA and are required to be locked closed.

If one or more of these valves is found not locked closed, the potential exists for the valves to be inadvertently opened. One hour is provided to lock closed the affected valves. The 1-hour Completion Time provides a period of time to correct the problem commensurate with the importance of maintaining these valves closed.

E.1 and E.2 If the Required Actions and associated Completion Times are not met, the plant must be brought to a MODE in which the LCO does not apply.

To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.3.1 REQUIREMENTS This SR ensures that the 8-inch purge exhaust and 12 inch air room supply valves are locked closed as required. If a valve is open, or closed but not locked, in violation of this SR, the valve is considered inoperable.

Valves may be locked closed electrically, mechanically, or by other physical means. These valves may be unable to close in the environment following a LOCA. Therefore, each of the valves is required to remain closed during MODES 1, 2, 3, and 4. The 31-day Frequency is consistent with other containment isolation valve requirements discussed in SR 3.6.3.2.

Palisades Nuclear Plant B 3.6.3-9 Revised 04/14/2011

Containment Isolation Valves B 3.6.3 BASES SURVEILLANCE SR 3.6.3.2 REQUIREMENTS (continued) This SR requires verification that each manual containment isolation valve and blind flange located outside containment, and not locked, sealed, or otherwise secured in position, and required to be closed during accident conditions, is closed. The SR helps to ensure that post accident leakage of fission products outside the containment boundary is within design limits. This SR does not require any testing or device manipulation. Rather, it involves verification that those containment isolation devices outside containment and capable of being mispositioned are in the correct position. Since verification of device position for containment isolation devices outside containment is relatively easy, the 31-day Frequency is based on engineering judgment and was chosen to provide added assurance of the correct positions. Containment isolation valves that are open under administrative controls are not required to meet the SR during the time the valves are open. This SR does not apply to devices that are locked, sealed, or otherwise secured in the closed position, since these were verified to be in the correct position upon locking, sealing, or securing.

The Note applies to valves and blind flanges located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, 3, and 4 for ALARA reasons. Therefore, the probability of misalignment of these containment isolation devices, once they have been verified to be in the proper position, is small.

SR 3.6.3.3 This SR requires verification that each containment isolation manual valve and blind flange located inside containment and not locked, sealed or otherwise secured in position, and required to be closed during accident conditions, is closed. The SR helps to ensure that post accident leakage of fission products outside the containment boundary is within design limits. For containment isolation devices inside containment, the Frequency of "prior to entering MODE 4 from MODE 5 if not performed within the previous 92 days" is appropriate, since these containment isolation devices are operated under administrative controls and the probability of their misalignment is low. Containment isolation valves that are open under administrative controls are not required to meet the SR during the time that they are open. This SR does not apply to devices that are locked, sealed, or otherwise secured in the closed position, since these were verified to be in the correct position upon locking, sealing, or securing.

Palisades Nuclear Plant B 3.6.3-10 Revised 04/14/2011

Containment Isolation Valves B 3.6.3 BASES SURVEILLANCE SR 3.6.3.3 (continued)

REQUIREMENTS The Note allows valves and blind flanges located in high radiation areas to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, and 3 for ALARA reasons. Therefore, the probability of misalignment of these containment isolation devices, once they have been verified to be in their proper position, is small.

SR 3.6.3.4 Verifying that the isolation time of each automatic power operated containment isolation valve is within limits is required to demonstrate OPERABILITY. The isolation time test ensures the valve will isolate in a time period less than or equal to that assumed in the safety analysis. The isolation time and Frequency of this SR are in accordance with the Inservice Testing Program.

SR 3.6.3.5 For containment 8 inch purge exhaust and 12 inch air room supply valves with resilient seals, additional leakage rate testing beyond the test requirements of 10 CFR 50, Appendix J, Option B (Ref. 3), is required to ensure the valves are physically closed (SR 3.6.3.1 verifies the valves are locked closed). Operating experience has demonstrated that this type of seal has the potential to degrade in a shorter time period than do other seal types. Based on this observation and the importance of maintaining this penetration leak tight (due to the direct path between containment and the environment), a Frequency of 184 days was established as part of the NRC resolution of Generic Issue B-20, "Containment Leakage Due to Seal Deterioration" (Ref. 4) as specified in the Safety Evaluation for Amendment No. 90 to the Facility Operating License.

Palisades Nuclear Plant B 3.6.3-11 Revised 04/14/2011

Containment Isolation Valves B 3.6.3 BASES SURVEILLANCE SR 3.6.3.6 REQUIREMENTS (continued) Automatic containment isolation valves close on a containment isolation signal to minimize leakage of fission products from containment following a DBA. This SR ensures each automatic containment isolation valve will actuate to its isolation position on an actual or simulated actuation signal, i.e., CHP or CHR. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The 18 month Frequency was developed considering it is prudent that this SR be performed only during a plant outage, since isolation of penetrations would eliminate cooling water flow and disrupt normal operation of many critical components. Operating experience has shown that these components usually pass this SR when performed on the 18 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

REFERENCES 1. FSAR, Section 5.8

2. FSAR, Section 6.7.2 and Table 6-14

3. 10 CFR 50, Appendix J, Option B

4. Generic Issue B-20

5. FSAR, Chapter 14

6. FSAR, Section 1.4.16 Palisades Nuclear Plant B 3.6.3-12 Revised 04/14/2011

Condensate Storage and Supply B 3.7.6 B 3.7 PLANT SYSTEMS B 3.7.6 Condensate Storage and Supply BASES BACKGROUND The Condensate Storage and Supply provides a safety grade source of water to the steam generators for removing decay and sensible heat from the Primary Coolant System (PCS). The Condensate Storage Tank (CST) and the Primary Makeup Storage Tank (T-81) provide a passive flow of water, by gravity, to the Auxiliary Feedwater (AFW) System (LCO 3.7.5, "Auxiliary Feedwater (AFW) System"). Three AFW pumps take a suction from a common line from the CST. T-81 provides makeup to the CST either by use of a pump or by gravity flow. Backup sources from the Service Water System (SWS) and Fire Water System provide additional water supply to the AFW pump suctions if the normal source is lost. SWS provides an emergency source to AFW pump P-8C, and the Fire Water System provides an emergency source to AFW pumps P-8A and P-8B. The steam produced is released to the atmosphere by the Main Steam Safety Valves (MSSVs) or the atmospheric dump valves.

The AFW pumps operate with a continuous recirculation to the CST.

When the main steam isolation valves are open, the preferred means of heat removal is to discharge steam to the condenser by the nonsafety grade path of the turbine bypass valve. This has the advantage of conserving condensate while minimizing releases to the environment.

Because the CST is a principal component in removing residual heat from the PCS, it is designed to withstand earthquakes. The tornado protected supply is provided by the SWS and Fire Water System. The CST is designed to Seismic Category I requirements to ensure availability of the feedwater supply.

A description of the Condensate Storage and Supply is found in the FSAR, Section 9.7 (Ref. 1).

Palisades Nuclear Plant B 3.7.6-1 Revised 04/14/2011

Condensate Storage and Supply B 3.7.6 BASES APPLICABLE The Condensate Storage and Supply provides condensate to remove SAFETY ANALYSES decay heat and to cool down the plant following all events in the accident analysis, discussed in the FSAR, Chapters 5 and 14. For anticipated operational occurrences and accidents which do not affect the OPERABILITY of the steam generators, the analysis assumption is generally 30 minutes at MODE 3, steaming through the MSSVs followed by a cooldown to Shutdown Cooling (SDC) entry conditions at the design cooldown rate.

The Condensate Storage and Supply satisfies Criterion 3 of 10 CFR 50.36(c)(2).

LCO To satisfy accident analysis assumptions, the CST and T-81 must contain sufficient cooling water to remove decay heat for 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months following a reactor trip from 2580.6 MWth. This amount of time allows for cool down of the PCS to SDC entry conditions, assuming a coincident loss of offsite power and the most adverse single failure. In doing this the CST and T-81 must retain sufficient water to ensure adequate net positive suction head for the AFW pumps, and makeup for steaming required to remove decay heat.

OPERABILITY of the Condensate Storage and Supply System is determined by maintaining the combined tank levels at or above the minimum required volume.

APPLICABILITY In MODES 1, 2, and 3, and in MODE 4, when steam generator is being relied upon for heat removal, the Condensate Storage and Supply is required to be OPERABLE.

In MODES 5 and 6, the Condensate Storage and Supply is not required because the AFW System is not required.

Palisades Nuclear Plant B 3.7.6-2 Revised 04/14/2011

Condensate Storage and Supply B 3.7.6 BASES ACTIONS A.1 and A.2 If the condensate volume is not within the limit, the OPERABILITY of the backup water supplies must be verified by administrative means within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months and once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter.

OPERABILITY of the backup feedwater supplies must include verification of the OPERABILITY of flow paths from the Fire Water System and SWS to the AFW pumps, and availability of the water in the backup supplies.

The Condensate Storage and Supply volume must be returned to OPERABLE status within 7 days, as the backup supplies may be performing this function in addition to their normal functions. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is reasonable, based on operating experience, to verify the OPERABILITY of the Fire Water System and SWS. Additionally, verifying the backup water supplies every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is adequate to ensure the backup water supplies continue to be available. The 7 day Completion Time is reasonable, based on OPERABLE backup water supplies being available, and the low probability of an event requiring the use of the water from the CST and T-81 occurring during this period.

As stated in SR 3.0.2, the 25% extension allowed by SR 3.0.2 may be applied to Required Actions whose Completion Time is stated as once per . . . however, the 25% extension does not apply to the initial performance of a Required Action with a periodic Completion Time that requires performance on a "once per . . ." basis. The 25% extension applies to each performance of the Required Action after the initial performance. Therefore, while Required Action 3.7.6 A.1 must be initially performed within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months without any SR 3.0.2 extension, subsequent performances at the Once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months interval may utilize the 25% SR 3.0.2 extension.

B.1 and B.2 If the condensate volume cannot be restored to OPERABLE status within the associated Completion Time, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 4, without reliance on steam generator for heat removal, within 30 hours3.472222e-4 days 0.00833 hours 4.960317e-5 weeks 1.1415e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

Palisades Nuclear Plant B 3.7.6-3 Revised 04/14/2011

Condensate Storage and Supply B 3.7.6 BASES SURVEILLANCE SR 3.7.6.1 REQUIREMENTS This SR verifies that the combination of CST and T-81 contain the required useable volume of cooling water. (This volume ³ 100,000 gallons.) The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is based on operating experience, and the need for operator awareness of plant evolutions that may affect the Condensate Storage and Supply inventory between checks. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is considered adequate in view of other indications in the control room, including alarms, to alert the operator to abnormal CST and T-81 level deviations.

REFERENCES 1. FSAR, Section 9.7 Palisades Nuclear Plant B 3.7.6-4 Revised 04/14/2011

UHS B 3.7.9 B 3.7 PLANT SYSTEMS B 3.7.9 Ultimate Heat Sink (UHS)

BASES BACKGROUND The UHS provides a heat sink for process and operating heat from safety related components during a Design Basis Accident (DBA) or transient, as well as during normal operation. This is done utilizing the Service Water System (SWS).

The UHS has been defined as Lake Michigan. The two principal functions of the UHS are the dissipation of residual heat after reactor shutdown, and dissipation of residual heat after an accident.

The basic performance requirements are that an adequate Net Positive Suction Head (NPSH) to the SWS pumps be available, and that the design basis temperatures of safety related equipment not be exceeded.

Additional information on the design and operation of the system along with a list of components served can be found in FSAR, Section 9.1 (Ref. 1).

APPLICABLE The UHS is the sink for heat removed from the reactor core following all SAFETY ANALYSES accidents and anticipated operational occurrences in which the plant is cooled down and placed on shutdown cooling. Maximum post accident heat load occurs between 20 to 40 minutes after a design basis Loss of Coolant Accident (LOCA). Near this time, the plant switches from injection to recirculation, and the containment cooling systems are required to remove the core decay heat.

Palisades Nuclear Plant B 3.7.9-1 Revised 04/14/2011

UHS B 3.7.9 BASES APPLICABLE The minimum water level of the UHS is based on the NPSH SAFETY ANALYSES requirements for the SWS pumps. The NPSH calculation assumes a (continued) minimum water level of 4 feet above the bottom of the pump suction bell which corresponds to an elevation of 557.25 ft. Violation of the SWS pump submergence requirement should never become a factor unless the Lake Michigan water level falls below the top of the sluice gate opening which is at elevation 568.25 ft. Early warning of a falling intake water level is provided by the intake structure level alarm. The nominal lake level is approximately 580 ft mean sea level. The maximum water temperature of the UHS is based on conservative heat transfer analyses for the worst case LOCA. FSAR, Section 14.18 (Ref. 2) and Design Basis Document (DBD) 1.02 (Ref. 3) provide the details of the analysis which forms the basis for these operating limits. The assumptions include: worst expected meteorological conditions, conservative uncertainties when calculating decay heat, and the worst case single active failure.

The UHS satisfies Criterion 3 of 10 CFR 50.36(c)(2).

LCO The UHS is required to be OPERABLE. The UHS is considered OPERABLE if it contains a sufficient volume of water at or below the maximum temperature that would allow the SWS to operate without the loss of NPSH, and without exceeding the maximum design temperature of the equipment served by the SWS. To meet this condition, the UHS temperature should not exceed 85°F and the level should not fall below 568.25 ft above mean sea level during normal plant operation.

APPLICABILITY In MODES 1, 2, 3, and 4, the UHS is a normally operating system that is required to support the OPERABILITY of the equipment serviced by the UHS and required to be OPERABLE in these MODES.

In MODES 5 and 6, the OPERABILITY requirements of the UHS are determined by the systems it supports.

Palisades Nuclear Plant B 3.7.9-2 Revised 04/14/2011

UHS B 3.7.9 BASES ACTIONS A.1 and A.2 If the UHS is inoperable, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.7.9.1 REQUIREMENTS This SR verifies adequate cooling can be maintained. The level specified also ensures sufficient NPSH is available for operating the SWS pumps. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency is based on operating experience related to the trending of the parameter variations during the applicable MODES. This SR verifies that the UHS water level is ³ 568.25 ft above mean sea level as measured within the boundaries of the intake structure.

SR 3.7.9.2 This SR verifies that the SWS is available to provide adequate cooling for normal design heat loads and maximum accident conditions following a DBA. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency is based on operating experience related to the trending of the parameter variations during the applicable MODES. This SR verifies that the water temperature from the UHS is £ 85°F.

REFERENCES 1. FSAR, Section 9.1

2. FSAR, Section 14.18

3. Design Basis Document (DBD) 1.02, Service Water System Palisades Nuclear Plant B 3.7.9-3 Revised 04/14/2011

Secondary Specific Activity B 3.7.17 B 3.7 PLANT SYSTEMS B 3.7.17 Secondary Specific Activity BASES BACKGROUND Activity in the secondary coolant results from steam generator tube outleakage from the Primary Coolant System (PCS). Under steady state conditions, the activity is primarily iodines with relatively short half lives, and thus is indication of current conditions. During transients, I-131 spikes have been observed as well as increased releases of some noble gases. Other fission product isotopes, as well as activated corrosion products in lesser amounts, may also be found in the secondary coolant.

A limit on secondary coolant specific activity during power operation minimizes releases to the environment because of normal operation, anticipated operational occurrences, and accidents.

This limit is lower than the activity value that might be expected from a 0.3 gpm tube leak of primary coolant at the limit of 1.0 Ci/gm as assumed in the safety analyses with exception of the control rod ejection analysis which assumes 0.3 gpm. The steam line failure is assumed to result in the release of the noble gas and iodine activity contained in the steam generator inventory, the feedwater, and primary coolant LEAKAGE. Most of the iodine isotopes have short half lives (i.e., < 20 hours2.314815e-4 days 0.00556 hours 3.306878e-5 weeks 7.61e-6 months ).

Operating a plant at the allowable limits would result in a 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Exclusion Area Boundary (EAB) exposure well within the 10 CFR 100 (Ref. 1) limits.

APPLICABLE The accident analysis of the Main Steam Line Break (MSLB), outside of SAFETY ANALYSES containment as discussed in the FSAR, Chapter 14.14 (Ref. 2) assumes the initial secondary coolant specific activity to have a radioactive isotope concentration of 0.10 Ci/gm DOSE EQUIVALENT I-131. This assumption is used in the analysis for determining the radiological consequences of the postulated accident. The accident analysis, based on this and other assumptions, shows that the radiological consequences of an MSLB are well within the plant EAB limits (Ref. 1) for whole body and thyroid dose rates.

Palisades Nuclear Plant B 3.7.17-1 Revised 04/14/2011

Secondary Specific Activity B 3.7.17 BASES APPLICABLE With the loss of offsite power, the remaining steam generator is SAFETY ANALYSES available for core decay heat dissipation by venting steam to the (continued) atmosphere through Main Steam Safety Valves (MSSVs) and Atmospheric Dump Valves (ADVs). The Auxiliary Feedwater System supplies the necessary makeup to the steam generator. Venting continues until the primary coolant temperature and pressure have decreased sufficiently for the Shutdown Cooling System to complete the cooldown.

In the evaluation of the radiological consequences of this accident, the activity released from the steam generator connected to the failed steam line is assumed to be released directly to the environment. The unaffected steam generator is assumed to discharge steam and any entrained activity through MSSVs and ADVs during the event.

Secondary specific activity limits satisfy Criterion 2 of 10 CFR 50.36(c)(2).

LCO As indicated in the Applicable Safety Analyses, the specific activity limit in the secondary coolant system of £ 0.10 Ci/gm DOSE EQUIVALENT I-131 limits the radiological consequences of a Design Basis Accident (DBA) to well within the required limit (Ref. 1).

Monitoring the specific activity of the secondary coolant ensures that when secondary specific activity limits are exceeded, appropriate actions are taken in a timely manner to place the plant in an operational MODE that would minimize the radiological consequences of a DBA.

APPLICABILITY In MODES 1, 2, 3, and 4, the limits on secondary specific activity apply due to the potential for secondary steam releases to the atmosphere.

In MODES 5 and 6, the steam generators are not being used for heat removal. Both the PCS and steam generators are at low pressure or depressurized, and primary to secondary LEAKAGE is minimal.

Therefore, monitoring of secondary specific activity is not required.

Palisades Nuclear Plant B 3.7.17-2 Revised 04/14/2011

Secondary Specific Activity B 3.7.17 BASES ACTIONS A.1 and A.2 DOSE EQUIVALENT I-131 exceeding the allowable value in the secondary coolant is an indication of a problem in the PCS and contributes to increased post accident doses. If secondary specific activity cannot be restored to within limits in the associated Completion Time, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be placed in at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , and in MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.7.17.1 REQUIREMENTS This SR ensures that the secondary specific activity is within the limits of the accident analysis. A gamma isotope analysis of the secondary coolant, which determines DOSE EQUIVALENT I-131, confirms the validity of the safety analysis assumptions as to the source terms in post accident releases. It also serves to identify and trend any unusual isotopic concentrations that might indicate changes in primary coolant activity or LEAKAGE. The 31 day Frequency is based on the detection of increasing trends of the level of DOSE EQUIVALENT I-131, and allows for appropriate action to be taken to maintain levels below the LCO limit.

REFERENCES 1. 10 CFR 100.11

2. FSAR, Section 14.14 Palisades Nuclear Plant B 3.7.17-3 Revised 04/14/2011

AC Sources - Operating B 3.8.1 3.8 ELECTRICAL POWER SYSTEMS B 3.8.1 AC Sources - Operating BASES BACKGROUND The plant Class 1E Electrical Power Distribution System AC sources consist of the offsite power sources, and the onsite standby power sources, Diesel Generators 1-1 and 1-2 (DGs). As required by 10 CFR 50, Appendix A, GDC 17 (Ref. 1), the design of the AC electrical power system provides independence and redundancy to ensure an available source of power to the Engineered Safety Feature (ESF) systems.

The AC power system at Palisades consists of a 345 kV switchyard, three circuits connecting the plant with off-site power (station power, startup, and safeguards transformers), the on-site distribution system, and two DGs. The on-site distribution system is divided into safety related (Class 1-E) and non-safety related portions.

The switchyard interconnects six transmission lines from the off-site transmission system, the output line from the Covert Generating Station, and the output line from the Palisades main generator. These lines are connected in a "breaker and a half" scheme between the Front (F) and Rear (R) buses such that any single off-site line may supply the Palisades station loads when the plant is shutdown.

Two circuits supplying Palisades 2400 V buses from off-site are fed directly from a switchyard bus through the startup and safeguards transformers. They are available both during operation and during shutdown. The third circuit supplies the plant loads by "back feeding" through the main generator output circuit and station power transformers after the generator has been disconnected by a motor operated disconnect.

The station power transformers are connected into the main generator output circuit. Station power transformers 1-1 and 1-2 connect to the generator 22 kV output bus. Station power transformer 1-3 connects to the generator output line on the high voltage side of the main transformer. Station power transformers 1-1 and 1-3 supply non-safety related 4160 V loads during plant power operation and during backfeeding operations. Station power transformer 1-2 can supply both safety related and non-safety related 2400 V loads during plant power operation or backfeeding operation.

Palisades Nuclear Plant B 3.8.1-1 Revised 04/14/2011

AC Sources - Operating B 3.8.1 BASES BACKGROUND The three startup transformers are connected to a common 345 kV (continued) overhead line from the switchyard R bus. Startup transformers 1-1 and 1-3 supply 4160 V non-safety related station loads; Startup Transformer 1-2 can supply both safety related and non-safety related 2400 V loads.

The startup transformers are available during operation and shutdown.

Safeguards Transformer 1-1 is connected to the switchyard F bus. It feeds station 2400 V loads through an underground line. It is available to supply these loads during operation and shutdown.

The onsite distribution system consists of seven main distribution buses (4160 V buses 1A, 1B, 1F, and 1G, and 2400 V buses 1C, 1D, and 1E) and supported lower voltage buses, Motor Control Centers (MCCs), and lighting panels. The 4160 V buses and 2400 V bus 1E are not safety related. Buses 1C and 1D and their supported buses and MCCs form two independent, redundant, safety related distribution trains. Each distribution train supplies one train of engineered safety features equipment.

In the event of a generator trip, all loads supplied by the station power transformers are automatically transferred to the startup transformers.

Loads supplied by the safeguards transformer are unaffected by a plant trip. If power is lost to the safeguards transformer, the 2400 V loads will automatically transfer to startup transformer 1-2. If the startup transformers are not energized when these transfers occur, their output breakers will be blocked from closing and the 2400 V safety related buses will be energized by the DGs.

The two DGs each supply one 2400 V bus. They provide backup power in the event of loss of off-site power, or loss of power to the associated 2400 V bus. The continuous rating of the DGs is 2500 kW, with 110 percent overload permissible for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . The required fuel in the Fuel Oil Storage Tank and DG Day Tank will supply one DG for a minimum period of 7 days assuming accident loading conditions and fuel conservation practices.

If either 2400 V bus, 1C or 1D, experiences a sustained undervoltage, the associated DG is started, the affected bus is separated from its offsite power sources, major loads are stripped from that bus and its supported buses, the DGs are connected to the bus, and ECCS or shutdown loads are started by an automatic load sequencer.

Palisades Nuclear Plant B 3.8.1-2 Revised 04/14/2011

AC Sources - Operating B 3.8.1 BASES BACKGROUND The DGs share a common fuel oil storage and transfer system. A (continued) single buried Fuel Oil Storage Tank is used, along with an individual day tank for each DG, to maintain the required fuel oil inventory. Two fuel transfer pumps are provided. The fuel transfer pumps are necessary for long-term operation of the DGs. Testing has shown that each DG consumes about 2.6 gallons of fuel oil per minute at 2400 kW. Each day tank is required to contain at least 2500 gallons. Therefore, each fuel oil day tank contains sufficient fuel for more than 15 hours1.736111e-4 days 0.00417 hours 2.480159e-5 weeks 5.7075e-6 months of full load (2500 kW) operation. Beyond that time, a fuel transfer pump is required for continued DG operation.

Either fuel transfer pump is capable of supplying either DG. However, each fuel transfer pump is not capable, with normally available switching, of being powered from either DG. DG 1-1 can power either fuel transfer pump, but DG 1-2 can only power P-18A. The fuel oil pumps share a common fuel oil storage tank, and common piping.

Fuel transfer pump P-18A is powered from MCC-8, which is normally connected to Bus 1D (DG 1-2) through Station Power Transformer 12 and Load Center 12. In an emergency, P-18A can be powered from Bus 1C (DG 1-1) by cross-connecting Load Centers 11 and 12.

Fuel transfer pump P-18B is powered from MCC-1, which is normally connected to Bus 1C (DG 1-1) through Station Power Transformer 19 and Load Center 19. P-18B cannot be powered, using installed equipment, from Bus 1D (DG 1-2).

APPLICABLE The safety analyses do not explicitly address AC electrical power. They SAFETY ANALYSES do, however, assume that the Engineered Safety Features (ESF) are available. The OPERABILITY of the ESF functions is supported by the AC Power Sources.

The design requirements are for each assumed safety function to be available under the following conditions:

a. The occurrence of an accident or transient,

b. The resultant consequential failures,

c. A worst-case single active failure,

d. Loss of all offsite or all onsite AC power, and

e. The most reactive control rod fails to insert.

Palisades Nuclear Plant B 3.8.1-3 Revised 04/14/2011

AC Sources - Operating B 3.8.1 BASES APPLICABLE One proposed mechanism for the loss of off-site power is a perturbation SAFETY ANALYSES of the transmission grid because of the loss of the plant's generating (continued) capacity. A loss of off-site power as a result of a generator trip can only occur during MODE 1 with the generator connected to the grid.

However, it is also assumed in analysis for some events in MODE 2, such as a control rod ejection. No specific mechanism for initiating a loss of off-site power when the plant is not on the line is discussed in the FSAR.

In most cases, it is conservative to assume that off-site power is lost concurrent with the accident and that the single failure is that of a DG.

That would leave only one train of safeguards equipment to cope with the accident, the other being disabled by the loss of AC power. Those analyses which assume that a loss of off-site power and failure of a single DG accompany the accident assume 11 seconds from the loss of power until the bus is re-energized. This time includes time for all portions of the circuitry necessary for detecting the undervoltage (relays and auxiliary relays) and starting the DG. Included in the 11 seconds, the analyses also assume 10 seconds for the DG to start and connect to the bus, and additional time for the sequencer to start each safeguards load.

The same assumptions are not conservative for all accident analyses.

When analyzing the effects of a steam or feed line break, the loss of the condensate and feedwater pumps would reduce the steam generator inventory, so a loss of off-site power is not assumed.

In MODE 5 and MODE 6, loss of off-site power can be considered as an initiating event for a loss of shutdown cooling event.

The AC sources satisfy Criterion 3 of 10 CFR 50.36(c)(2).

LCO Two qualified circuits between the offsite transmission network and the onsite Class 1E Electrical Power Distribution System and an independent DG for each safeguards train ensure availability of the required power to shut down the reactor and maintain it in a safe shutdown condition after an anticipated operational occurrence or a postulated DBA.

Palisades Nuclear Plant B 3.8.1-4 Revised 04/14/2011

AC Sources - Operating B 3.8.1 BASES LCO General Design Criterion 17 (Ref. 1) requires, in part, that: "Electric (continued) power from the transmission network to the onsite electric distribution system shall be supplied by two physically independent circuits (not necessarily on separate rights of way) designed and located so as to minimize to the extent practical the likelihood of their simultaneous failure under operating and postulated accident and environmental conditions."

The qualified offsite circuits available are Safeguards Transformer 1-1 and Startup Transformer 1-2. Station Power Transformer 1-2 is not qualified as a required source for LCO 3.8.1 since it is not independent of the other two offsite circuits. This LCO does not prohibit use of Station Power Transformer 1-2 to power the 2400 V safety related buses, but the equipment alignment utilized to achieve this configuration results the qualified offsite circuit from the Safeguards Transformer 1-1 to be declared inoperable. Therefore, aligning Station Power Transformer 1-2 to supply the 2400 V safety buses requires entry into an action statement of LCO 3.8.1.

Each offsite circuit must be capable of maintaining acceptable frequency and voltage, and accepting required loads during an accident, while supplying the 2400 V safety related buses.

Following a loss of offsite power, each DG must be capable of starting and connecting to its respective 2400 V bus. This will be accomplished within 10 seconds after receipt of a DG start signal. Each DG must also be capable of accepting required loads within the assumed loading sequence intervals, and continue to operate until offsite power can be restored to the 2400 V safety related buses.

Proper sequencing of loads and tripping of nonessential loads are required functions for DG OPERABILITY.

APPLICABILITY The AC sources are required to be OPERABLE above MODE 5 to ensure that redundant sources of off-site and on-site AC power are available to support engineered safeguards equipment in the event of an accident or transient. The AC sources also support the equipment necessary for power operation, plant heatups and cooldowns, and shutdown operation.

The AC source requirements for MODES 5 and 6, and during movement of irradiated fuel assemblies are addressed in LCO 3.8.2, "AC Sources - Shutdown."

Palisades Nuclear Plant B 3.8.1-5 Revised 04/14/2011

AC Sources - Operating B 3.8.1 BASES ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable DG.

There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an inoperable DG and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.

A.1 To ensure a highly reliable power source remains with the one offsite circuit inoperable, it is necessary to verify the OPERABILITY of the remaining required offsite circuit on a more frequent basis. Since the Required Action only specifies "perform," a failure of SR 3.8.1.1 acceptance criteria does not result in failure to meet this Required Action. However, if a second required circuit fails SR 3.8.1.1, the second offsite circuit is inoperable, and Condition C, for two offsite circuits inoperable, is entered.

As stated in SR 3.0.2, the 25% extension allowed by SR 3.0.2 may be applied to Required Actions whose Completion Time is stated as once per . . . however, the 25% extension does not apply to the initial performance of a Required Action with a periodic Completion Time that requires performance on a "once per . . ." basis. The 25% extension applies to each performance of the Required Action after the initial performance. Therefore, while Required Action 3.8.1 A.1 must be initially performed within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months without any SR 3.0.2 extension, subsequent performances at the Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months interval may utilize the 25% SR 3.0.2 extension.

A.2 According to the recommendations of Regulatory Guide (RG) 1.93 (Ref. 2), operation may continue in Condition A for a period that should not exceed 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . With one offsite circuit inoperable, the reliability of the offsite system is degraded, and the potential for a loss of offsite power is increased, with attendant potential for a challenge to the plant safety systems. In this Condition, however, the remaining OPERABLE offsite circuit and DGs are adequate to supply electrical power to the onsite Class 1E Distribution System.

Palisades Nuclear Plant B 3.8.1-6 Revised 04/14/2011

AC Sources - Operating B 3.8.1 BASES ACTIONS A.2 (continued)

The 72-hour Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period. The second Completion Time for Required Action A.2 establishes a limit on the maximum time allowed for any combination of required AC power sources to be inoperable during any single continuous occurrence of failing to meet the LCO. If Condition A is entered while, for instance, a DG is inoperable, and that DG is subsequently returned OPERABLE, the LCO may already have been not met for up to 7 days. This could lead to a total of 10 days, since initial failure to meet the LCO, to restore the offsite circuit. At this time, a DG could again become inoperable, the circuit restored OPERABLE, and an additional 7 days (for a total of 17 days) allowed prior to complete restoration of the LCO. The 10-day Completion Time provides a limit on the time allowed in a specified condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which Conditions A and B are entered concurrently. The AND connector between the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months and 10 day Completion Time means that both Completion Times apply simultaneously, and the more restrictive Completion Time must be met.

The Completion Time allows for an exception to the normal time zero for beginning the Completion Time clock. This will result in establishing the time zero at the time that the LCO was initially not met, instead of at the time Condition A was entered.

B.1 To ensure a highly reliable power source remains with an inoperable DG, it is necessary to verify the availability of the offsite circuits on a more frequent basis. Since the Required Action only specifies "perform," a failure of SR 3.8.1.1 acceptance criteria does not result in a Required Action being not met. However, if a circuit fails to pass SR 3.8.1.1, it is inoperable. Upon offsite circuit inoperability, additional Conditions and Required Actions must then be entered.

Palisades Nuclear Plant B 3.8.1-7 Revised 04/14/2011

AC Sources - Operating B 3.8.1 BASES ACTIONS B.2 (continued)

In accordance with LCO 3.0.6, the requirement to declare required features inoperable carries with it the requirement to take those actions required by the LCO for that required equipment.

Required Action B.2 is intended to provide assurance that a loss of offsite power, during the period that a DG is inoperable, does not result in a complete loss of safety function of critical systems. These features are designed with redundant safety related trains. Redundant required feature failures consist of inoperable features within a train redundant to the train that has an inoperable DG. If the train that has an inoperable DG contains multiple features redundant to the inoperable feature in the other train, all those multiple features must be declared inoperable. For example, if DG 1-1 and Containment Spray Pump P-54A are inoperable concurrently, Containment Spray Pumps P-54B and P-54C must both be declared inoperable. In this example, if off-site power were lost, neither P-54B nor P-54C would be available.

The Completion Time for Required Action B.2 is intended to allow the operator time to evaluate and repair any discovered inoperabilities.

This Completion Time also allows for an exception to the normal "time zero" for beginning the Completion Time "clock." In this Required Action, the Completion Time only begins on discovery that both:

a. An inoperable DG exists; and

b. A required feature on the other train is inoperable.

If at any time during the existence of this Condition (one DG inoperable) a redundant required feature subsequently becomes inoperable, this Completion Time begins to be tracked.

Discovering one required DG inoperable coincident with one or more inoperable required supporting or supported features, or both, that are associated with the OPERABLE DG, results in starting the Completion Time for Required Action B.2. Four hours from the discovery of these events existing concurrently, is acceptable because it minimizes risk while allowing time for restoration before subjecting the plant to transients associated with shutdown.

In this Condition, the remaining OPERABLE DG and offsite circuits are adequate to supply electrical power to the onsite Class 1E Distribution System. Thus, on a component basis, single failure protection for the required feature's function may have been lost; however, function has not been lost.

Palisades Nuclear Plant B 3.8.1-8 Revised 04/14/2011

AC Sources - Operating B 3.8.1 BASES ACTIONS B.2 (continued)

The 4-hour Completion Time takes into account the OPERABILITY of the redundant counterpart to the inoperable required feature.

Additionally, the 4-hour Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

B.3.1 and B.3.2 Required Action B.3 provides an allowance to avoid unnecessary testing of the OPERABLE DG. If it can be determined that the cause of the inoperable DG does not exist on the OPERABLE DG, SR 3.8.1.2 (test starting of the OPERABLE DG) does not have to be performed. If the cause of inoperability exists on other DGs, the other DGs would be declared inoperable upon discovery and Condition E of LCO 3.8.1 would be entered. Once the failure is repaired, the common cause failure no longer exists and Required Action B.3.1 is satisfied. If the cause of the initial inoperable DG cannot be confirmed to not exist on the remaining DG, performance of SR 3.8.1.2 suffices to provide assurance of continued OPERABILITY of that DG.

In the event the inoperable DG is restored to OPERABLE status prior to completing Required Action B.3.1 or B.3.2 the corrective action system would normally continue to evaluate the common cause possibility.

This continued evaluation, however, is no longer under the 24-hour constraint imposed while in Condition B. According to Generic Letter 84-15 (Ref. 3), 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is reasonable to confirm that the OPERABLE DG is not affected by the same problem as the inoperable DG.

Palisades Nuclear Plant B 3.8.1-9 Revised 04/14/2011

AC Sources - Operating B 3.8.1 BASES ACTIONS B.4 (continued)

In Condition B, the remaining OPERABLE DG and offsite circuits are adequate to supply electrical power to the onsite Class 1E Distribution System for a limited period. The 7-day Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

The second Completion Time for Required Action B.4 establishes a limit on the maximum time allowed for any combination of required AC power sources to be inoperable during any single contiguous occurrence of failing to meet the LCO. If Condition B is entered while, for instance, an offsite circuit is inoperable and that circuit is subsequently returned OPERABLE, the LCO may already have been not met for up to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This could lead to a total of 10 days, since initial failure to meet the LCO, to restore the DG. At this time, an offsite circuit could again become inoperable, the DG restored OPERABLE, and an additional 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months (for a total of 13 days) allowed prior to complete restoration of the LCO. The 10-day Completion Time provides a limit on time allowed in a specified condition after discovery of failure to meet the LCO. This limit is considered reasonable for situations in which Conditions A and B are entered concurrently. The AND connector between the 7 day and 10 day Completion Time means that both Completion Times apply simultaneously, and the more restrictive Completion Time must be met.

As in Required Action B.2, the Completion Time allows for an exception to the normal time zero for beginning the allowed time clock. This will result in establishing the time zero at the time that the LCO was initially not met, instead of at the time Condition B was entered.

Palisades Nuclear Plant B 3.8.1-10 Revised 04/14/2011

AC Sources - Operating B 3.8.1 BASES ACTIONS C.1 (continued)

In accordance with LCO 3.0.6 the requirement to declare required features inoperable carries with it the requirement to take those actions required by the LCO for that required equipment.

Required Action C.1, which applies when two required offsite circuits are inoperable, is intended to provide assurance that an event with a coincident single failure will not result in a complete loss of redundant required safety functions. The Completion Time for this failure of redundant required features is reduced to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The rationale for the reduction to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is that RG 1.93 (Ref. 2) recommends a Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for two required offsite circuits inoperable, based upon the assumption that two complete safety trains are OPERABLE. When a concurrent redundant required feature failure exists, this assumption is not the case, and a shorter Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is appropriate. These features are powered from redundant AC safety trains.

The Completion Time for Required Action C.1 is intended to allow the operator time to evaluate and repair any discovered inoperabilities.

This Completion Time also allows for an exception to the normal "time zero" for beginning the Completion Time "clock." In this Required Action, the Completion Time only begins on discovery that both:

a. All required offsite circuits are inoperable; and

b. A required feature is inoperable.

If at any time during the existence of Condition C (two offsite circuits inoperable), a required feature becomes inoperable, this Completion Time begins to be tracked.

Palisades Nuclear Plant B 3.8.1-11 Revised 04/14/2011

AC Sources - Operating B 3.8.1 BASES ACTIONS C.2 (continued)

According to the recommendations of RG 1.93 (Ref. 2), operation may continue in Condition C for a period that should not exceed 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

This level of degradation means that the offsite electrical power system does not have the capability to accomplish a safe shutdown and to mitigate the effects of an accident; however, the onsite AC sources have not been degraded. This level of degradation generally corresponds to a total loss of the immediately accessible offsite power sources.

With both of the required offsite circuits inoperable, sufficient onsite AC sources are available to maintain the plant in a safe shutdown condition in the event of a DBA or transient. In fact, a simultaneous loss of offsite AC sources, a LOCA, and a worst-case single failure were postulated as a part of the design basis in the safety analysis. Thus, the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time provides a period of time to effect restoration of one of the offsite circuits commensurate with the importance of maintaining an AC electrical power system capable of meeting its design criteria.

If two offsite sources are restored within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , unrestricted operation may continue. If only one offsite source is restored within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , power operation continues in accordance with Condition A.

D.1 and D.2 Pursuant to LCO 3.0.6, the Distribution System ACTIONS would not be entered even if all AC sources to it were inoperable resulting in de-energization. Therefore, the Required Actions of Condition D are modified by a Note to indicate that when Condition D is entered with no AC source to any train, the Conditions and Required Actions for LCO 3.8.9, Distribution Systems - Operating, must be immediately entered. This allows Condition D to provide the requirements for the loss of one offsite circuit and one DG without regard to whether a train is de-energized. LCO 3.8.9 provides the appropriate restrictions for a de-energized train.

In Condition D, individual redundancy is lost in both the offsite electrical power system and the onsite AC electrical power system. The 12-hour Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

According to the recommendations of RG 1.93 (Ref. 2), operation may continue in Condition D for a period that should not exceed 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

Palisades Nuclear Plant B 3.8.1-12 Revised 04/14/2011

AC Sources - Operating B 3.8.1 BASES ACTIONS E.1 (continued)

With both DGs inoperable, there are no remaining standby AC sources.

Thus, with an assumed loss of offsite electrical power, no AC source would be available to power the minimum required ESF functions.

Since the offsite electrical power system is the only source of AC power for this level of degradation, the risk associated with continued operation for a short time could be less than that associated with an immediate controlled shutdown (the immediate shutdown could cause grid instability, which could result in a total loss of AC power). Since an inadvertent generator trip could also result in a total loss of offsite AC power, however, the time allowed for continued operation is severely restricted. The intent here is to avoid the risk associated with an immediate controlled shutdown and to minimize the risk associated with this level of degradation.

According to the recommendations of RG 1.93 (Ref. 2), with both DGs inoperable, operation may continue for a period that should not exceed 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

F.1 and F.2 If the inoperable AC power sources cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to an operating condition in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

G.1 Condition G corresponds to a level of degradation in which all redundancy in the AC electrical power supplies has been lost. At this severely degraded level, any further losses in the AC electrical power system will cause a loss of function. Therefore, no additional time is justified for continued operation. The unit is required by LCO 3.0.3 to commence a controlled shutdown.

Palisades Nuclear Plant B 3.8.1-13 Revised 04/14/2011

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE The AC sources are designed to permit inspection and testing of all REQUIREMENTS important areas and features, especially those that have a standby function, in accordance with 10 CFR 50, Appendix A, GDC 18 (Ref. 4).

Periodic component tests are supplemented by extensive functional tests during refueling outages (under simulated accident conditions).

The SRs for demonstrating the OPERABILITY of the DGs are in accordance with the recommendations of RG 1.9 (Ref. 5) and RG 1.137 (Ref. 6).

Where the SRs discussed herein specify voltage and frequency tolerances for the DGs operated in the "Unit" mode, the following is applicable. The minimum steady state output voltage of 2280 V is 95%

of the nominal 2400 V generator rating. This value is above the setting of the primary undervoltage relays (127-1 and 127-2) and above the minimum analyzed acceptable bus voltage. It also allows for voltage drops to motors and other equipment down through the 120 V level.

The specified maximum steady state output voltage of 2520 V is 105%

of the nominal generator rating of 2400 V. It is below the maximum voltage rating of the safeguards motors, 2530 V. The specified minimum and maximum frequencies of the DG are 59.5 Hz and 61.2 Hz, respectively. The minimum value assures that ESF pumps provide sufficient flow to meet the accident analyses. The maximum value is equal to 102% of the 60 Hz nominal frequency and is derived from the recommendations given in RG 1.9 (Ref. 5).

Higher maximum tolerances are specified for final steady state voltage and frequency following a loss of load test, because that test must be performed with the DG controls in the "Parallel" mode. Since "Parallel" mode operation introduces both voltage and speed droop, the DG final conditions will not return to the nominal "Unit" mode settings.

SR 3.8.1.1 This SR assures that the required offsite circuits are OPERABLE. Each offsite circuit must be energized from associated switchyard bus through its disconnect switch to be OPERABLE.

Since each required offsite circuit transformer has only one possible source of power, the associated switchyard bus, and since loss of voltage to either the switchyard bus or the transformer is alarmed in the control room, correct alignment and voltage may be verified by the absence of these alarms.

Palisades Nuclear Plant B 3.8.1-14 Revised 04/14/2011

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.1 (continued)

REQUIREMENTS The 7 day Frequency is adequate because disconnect switch positions cannot change without operator action and because their status is displayed in the control room.

SR 3.8.1.2 This SR helps to ensure the availability of the standby electrical power supply to mitigate DBAs and transients and to maintain the plant in a safe shutdown condition.

The monthly test starting of the DG provides assurance that the DG would start and be ready for loading in the time period assumed in the safety analyses. The monthly test, however does not, and is not intended to, test all portions of the circuitry necessary for automatic starting and loading. The operation of the bus undervoltage relays and their auxiliary relays which initiate DG starting, the control relay, which initiates DG breaker closure, and the DG breaker closure itself are not verified by this test. Verification of automatic operation of these components requires de-energizing the associated 2400 V bus and cannot be done during plant operation. For this test, the 10-second timing is started when the DG receives a start signal, and ends when the DG voltage sensing relays actuate. For the purposes of SR 3.8.1.2, the DGs are manually started from standby conditions. Standby conditions for a DG mean the diesel engine is not running, its coolant and oil temperatures are being maintained consistent with manufacturer recommendations, and ³ 20 minutes have elapsed since the last DG air roll.

Three relays sense the terminal voltage on each DG. These relays, in conjunction with a load shedding relay actuated by bus undervoltage, initiate automatic closing of the DG breaker. During monthly testing, the actuation of the three voltage sensing relays is used as the timing point to determine when the DG is ready for loading.

The 31-day Frequency for performance of SR 3.8.1.2 agrees with the original licensing basis for the Palisades plant.

Palisades Nuclear Plant B 3.8.1-15 Revised 04/14/2011

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.3 REQUIREMENTS (continued) This Surveillance verifies that the DGs are capable of synchronizing with the offsite electrical system and accepting loads greater than or equal to the equivalent of the maximum expected accident loads for at least 15 minutes. A minimum total run time of 60 minutes is required to stabilize engine temperatures.

During the period when the DG is paralleled to the grid, it must be considered inoperable. This is because there are no provisions to automatically shift the DG controls from parallel mode to unit mode.

Additionally, when paralleled, there are certain conditions where the protection schemes may not prevent DG overloading and subsequent breaker trip and lockout.

The 31-day Frequency for this Surveillance is consistent with the original Palisades licensing basis.

The SR is modified by three Notes. Note 1 states that momentary transients outside the required band do not invalidate this test. This is to assure that a minor change in grid conditions and the resultant change in DG load, or a similar event, does not result in a surveillance being unnecessarily repeated. Note 2 indicates that this Surveillance should be conducted on only one DG at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations. Note 3 stipulates a prerequisite requirement for performance of this SR. A successful DG start must precede this test to credit satisfactory performance.

SR 3.8.1.4 This SR provides verification that the level of fuel oil in the day tank is at or above the level at which fuel oil is automatically added. The specified level is adequate for a minimum of 15 hours1.736111e-4 days 0.00417 hours 2.480159e-5 weeks 5.7075e-6 months of DG operation at full load.

The 31-day Frequency is adequate to assure that a sufficient supply of fuel oil is available, since low-level alarms are provided and plant operators would be aware of any uses of the DG during this period.

Palisades Nuclear Plant B 3.8.1-16 Revised 04/14/2011

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.5 REQUIREMENTS (continued) Each DG is provided with an engine overspeed trip to prevent damage to the engine. The loss of a large load could cause diesel engine overspeed, which, if excessive, might result in a trip of the engine. This Surveillance demonstrates the DG load response characteristics and capability to reject the largest single load without exceeding predetermined voltage and frequency and while maintaining a specified margin to the overspeed trip. This Surveillance may be accomplished with the DG in the "Parallel" mode.

An acceptable method is to parallel the DG with the grid and load the DG to a load equal to or greater than its single largest post-accident load. The DG breaker is tripped while its voltage and frequency (or speed) are being recorded. The time, voltage, and frequency tolerances specified in this SR are derived from the recommendations of RG 1.9, Revision 3 (Ref. 5).

RG 1.9 (Ref. 5) recommends that the increase in diesel speed during the transient does not exceed 75% of the difference between synchronous speed and the overspeed trip setpoint, or 15% above synchronous speed, whichever is lower. The Palisades DGs have a synchronous speed of 900 rpm and an overspeed trip setting range of 1060 to 1105 rpm. Therefore, the maximum acceptable transient frequency for this SR is 68 Hz.

The minimum steady state voltage is specified to provide adequate margin for the switchgear and for both the 2400 and 480 V safeguards motors; the maximum steady state voltage is 2400 +10% V as recommended by RG 1.9 (Ref. 5).

The minimum acceptable frequency is specified to assure that the safeguards pumps powered from the DG would supply adequate flow to meet the safety analyses. The maximum acceptable steady state frequency is slightly higher than the +2% (61.2 Hz) recommended by RG 1.9 (Ref. 5) because the test must be performed with the DG controls in the Parallel mode. The increased frequency allowance of 0.3 Hz is based on the expected speed differential associated with performance of the test while in the "Parallel" mode.

The 18-month surveillance Frequency is consistent with the recommendation of RG 1.9 (Ref. 5).

Palisades Nuclear Plant B 3.8.1-17 Revised 04/14/2011

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.6 REQUIREMENTS (continued) This Surveillance demonstrates the DG capability to reject a full load without overspeed tripping or exceeding the predetermined voltage limits. The DG full load rejection may occur because of a system fault or inadvertent breaker tripping. This Surveillance ensures proper engine and generator load response under a complete loss of load.

These acceptance criteria provide DG damage protection. The 4000 V limitation is based on generator rating of 2400/4160V and the ratings of those components (connecting cables and switchgear) that would experience the voltage transient. While the DG is not expected to experience this transient during an event and continue to be available, this response ensures that the DG is not degraded for future application, including re-connection to the bus if the trip initiator can be corrected or isolated.

In order to ensure that the DG is tested under load conditions that are as close to design basis conditions as possible, yet still provide adequate testing margin between the specified power factor limit and the DG design power factor limit of 0.8, testing must be performed using a power factor £ 0.9. This is consistent with RG 1.9 (Ref. 5).

The 18-month Frequency is consistent with the recommendation of RG 1.9 (Ref. 5) and is intended to be consistent with expected fuel cycle lengths.

SR 3.8.1.7 As recommended by RG 1.9 (Ref. 5) this Surveillance demonstrates the as designed operation of the standby power sources during loss of the offsite source. This test verifies all actions encountered from the loss of offsite power, including shedding of the nonessential loads and re-energizing of the emergency buses and respective loads from the DG.

The requirement to energize permanently connected loads is met when the DG breaker closes, energizing its associated 2400 V bus.

Permanently connected loads are those that are not disconnected from the bus by load shedding relays. They are energized when the DG breaker closes. It is not necessary to monitor each permanently connected load.

Palisades Nuclear Plant B 3.8.1-18 Revised 04/14/2011

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.7 (continued)

REQUIREMENTS The DG auto-start and breaker closure time of 10 seconds is derived from requirements of the accident analysis to respond to a design basis large break LOCA. For this test, the 10-second timing is started when the DG receives a start signal, and ends when the DG breaker closes.

The safety analyses assume 11 seconds from the loss of power until the bus is re-energized.

The requirement to verify that auto-connected shutdown loads are energized refers to those loads that are actuated by the Normal Shutdown Sequencer. Each load should be started to assure that the DG is capable of accelerating these loads at the intervals programmed for the Normal Shutdown Sequence. The sequenced pumps may be operating on recirculation flow.

The requirements to maintain steady state voltage and frequency apply to the "steady state" period after all sequenced loads have been started. This period need only be long enough to achieve and measure steady voltage and frequency.

The Surveillance should be continued for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed and stability has been achieved. The requirement to supply permanently connected loads for ³ 5 minutes, refers to the duration of the DG connection to the associated safeguards bus. It is not intended to require that sequenced loads be operated throughout the 5-minute period. It is not necessary to monitor each permanently connected load.

The requirement to verify the connection and supply of permanently and automatically connected loads is intended to demonstrate the DG loading logic. This testing may be accomplished in any series of sequential, overlapping, or total steps so that the required connection and loading sequence is verified.

The Frequency of 18 months is consistent with the recommendations of RG 1.9 (Ref. 5).

This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems.

Palisades Nuclear Plant B 3.8.1-19 Revised 04/14/2011

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.8 REQUIREMENTS (continued) RG 1.9 (Ref. 5) recommends demonstration once per 18 months that the DGs can start and run continuously at full load capability for an interval of not less than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , ³ 120 minutes of which is at a load above its analyzed peak accident loading and the remainder of the time at a load equivalent to the continuous duty rating of the DG. SR 3.8.1.8 only requires ³ 100 minutes at a load above the DG analyzed peak accident loading. The 100 minutes required by the SR satisfies the intent of the recommendations of the RG, but allows some tolerance between the time requirement and the DG rating. Without this tolerance, the load would have to be reduced at precisely 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to satisfy the SR without exceeding the manufacturer's rating of the DG.

The DG starts for this Surveillance can be performed either from standby or hot conditions.

In order to ensure that the DG is tested under load conditions that are as close to design conditions as possible, yet still provide adequate testing margin between the specified power factor limit and the DG design power factor limit of 0.8, testing must be performed using a power factor of £ 0.9. The load band is provided to avoid routine overloading of the DG. Routine overloading may result in more frequent inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY.

In addition, a Note to the SR states that momentary transients outside the required band do not invalidate this test. This is to assure that a minor change in grid conditions and the resultant change in DG load, or a similar event, does not result in a surveillance being unnecessarily repeated.

During the period when the DG is paralleled to the grid, it must be considered inoperable. This is because there are no provisions to automatically shift the DG controls from parallel mode to unit mode.

Additionally, when paralleled, there are certain conditions where the protection schemes may not prevent DG overloading and subsequent breaker trip and lockout.

The 18-month Frequency is consistent with the recommendations of RG 1.9 (Ref. 5).

Palisades Nuclear Plant B 3.8.1-20 Revised 04/14/2011

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.9 REQUIREMENTS (continued) As recommended by RG 1.9 (Ref. 5), this Surveillance ensures that the manual synchronization and load transfer from the DG to the offsite source can be made and that the DG can be returned to ready to load status when offsite power is restored. The test is performed while the DG is supplying its associated 2400 V bus, but not necessarily carrying the sequenced accident loads. The DG is considered to be in ready to load status when the DG is at rated speed and voltage, the output breaker is open, the automatic load sequencer is reset, and the DG controls are returned to "Unit.

During the period when the DG is paralleled to the grid, it must be considered inoperable. This is because there are no provisions to automatically shift the DG controls from parallel mode to unit mode.

Additionally, when paralleled, there are certain conditions where the protection schemes may not prevent DG overloading and subsequent breaker trip and lockout.

The Frequency of 18 months is consistent with the recommendations of RG 1.9 (Ref. 5).

This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems.

Palisades Nuclear Plant B 3.8.1-21 Revised 04/14/2011

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.10 REQUIREMENTS (continued) If power is lost to bus 1C or 1D, loads are sequentially connected to the bus by the automatic load sequencer. The sequencing logic controls the permissive and starting signals to motor breakers to prevent overloading of the DGs by concurrent motor starting currents. The 0.3-second load sequence time tolerance ensures that sufficient time exists for the DG to restore frequency and voltage prior to applying the next load and ensures that safety analysis assumptions regarding ESF equipment time delays are met. Logic Drawing E-17 Sheet 4 (Ref. 7) provides a summary of the automatic loading of safety related buses.

The Frequency of 18 months is consistent with the recommendations of RG 1.9 (Ref. 5), takes into consideration plant conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems.

SR 3.8.1.11 In the event of a DBA coincident with a loss of offsite power, the DGs are required to supply the necessary power to ESF systems so that the fuel, PCS, and containment design limits are not exceeded.

The requirement to energize permanently connected loads is met when the DG breaker closes, energizing its associated 2400 V bus.

Permanently connected loads are those that are not disconnected from the bus by load shedding relays. They are energized when the DG breaker closes. It is not necessary to monitor each permanently connected load. The DG auto-start and breaker closure time of 10 seconds is derived from requirements of the accident analysis to respond to a design basis large break LOCA. For this test, the 10-second timing is started when the DG receives a start signal, and ends when the DG breaker closes. The safety analyses assume 11 seconds from the loss of power until the bus is re-energized.

Palisades Nuclear Plant B 3.8.1-22 Revised 04/14/2011

AC Sources - Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.11 (continued)

REQUIREMENTS In addition, a Note to the SR states that momentary transients outside the required band do not invalidate this test. This is to assure that a minor change in grid conditions and the resultant change in DG load, or a similar event, does not result in a surveillance being unnecessarily repeated.

The requirement to verify that auto-connected shutdown loads are energized refers to those loads that are actuated by the DBA Sequencer. Each load should be started to assure that the DG is capable of accelerating these loads at the intervals programmed for the DBA Sequence. Since the containment spray pumps do not actuate on SIS generated by Pressure Low Pressure, the test should be performed such that spray pump starting by the sequencer is also verified along with the other SIS loads. The sequenced pumps may be operating on recirculation flow or in other testing modes. The requirements to maintain steady state voltage and frequency apply to the "steady state" period after all sequenced loads have been started. This period need only be long enough to achieve and measure steady voltage and frequency.

The Surveillance should be continued for a minimum of 5 minutes in order to demonstrate that all starting transients have decayed and stability has been achieved. The requirement to supply permanently connected loads for ³ 5 minutes, refers to the duration of the DG connection to the associated 2400 V bus. It is not intended to require that sequenced loads be operated throughout the 5-minute period. It is not necessary to monitor each permanently connected load.

The Frequency of 18 months takes into consideration plant conditions required to perform the Surveillance and is intended to be consistent with an expected fuel cycle length of 18 months.

This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge safety systems.

Palisades Nuclear Plant B 3.8.1-23 Revised 04/14/2011

AC Sources - Operating B 3.8.1 BASES REFERENCES 1. 10 CFR 50, Appendix A, GDC 17

2. Regulatory Guide 1.93, December 1974

3. Generic Letter 84-15, July 2, 1984

4. 10 CFR 50, Appendix A, GDC 18

5. Regulatory Guide 1.9, Rev. 3, July 1993

6. Regulatory Guide 1.137, Rev. 1, October 1979

7. Palisades Logic Drawing E-17, Sheet 4 Palisades Nuclear Plant B 3.8.1-24 Revised 04/14/2011

PNP 2011-032, Report to NRC of Changes of Technical Specifications Bases

Text

SUBJECT:

Dear Sir or Madam:

Navigation menu

PNP 2011-032, Report to NRC of Changes of Technical Specifications Bases

Text

SUBJECT:

Dear Sir or Madam:

Navigation menu

Search