Entergy Nuclear Operations, Inc. En bnfff-ql Covert, MI ...Entergy Nuclear Operations, Inc. En Palisades Nuclear Plant bnfff-ql 27780 Blue Star Memorial Highway JL_.JILL.'1 Covert,

Entergy Nuclear Operations, Inc.Palisades Nuclear Plant

En bnfff-ql 27780 Blue Star Memorial HighwayJL_.JILL.'1 Covert, MI 49043

Tel 269-764-2000

Otto W Gustafson

Licensing Manager

PNP 2012-097November 9, 2012

U. S. Nuclear Regulatory CommissionATTN: Document Control DeskWashington, DC 20555-0001

SUBJECT: Report to NRC of Changes to Technical Specifications Bases

Palisades Nuclear PlantDocket 50-255License No. DPR-20

Dear Sir or Madam:

This report is submitted in accordance with Palisades Technical Specification 5.5.12.d,which requires that changes to the Technical Specifications Bases, implemented withoutprior Nuclear Regulatory Commission (NRC) approval, be provided to the NRC on afrequency consistent with 10 CFR 50.71(e). Attachment 1 provides a listing of all baseschanges since issuance of the previous report, dated April 25, 2011, and identifies theaffected sections and describes the nature of the changes. Attachment 2 provides pagechange instructions, a copy of the current Technical Specifications Bases List ofEffective Pages, and the revised Technical Specifications Bases sections and tablelisted in Attachment 1.

Summary of Commitments

This letter identifies no new commitments and no revisions to existing commitments.

Sincerely,

owg/rbh

Attachments: 1. List of Technical Specifications Bases Changes2. Revised Technical Specifications Bases

cc: Administrator, Region III, USNRCProject Manager, Palisades, USNRCResident Inspector, Palisades, USNRC

-Acoo(

ATTACHMENT 1

LIST OF TECHNICAL SPECIFICATIONS BASES CHANGES

Date Affected Bases Change Description

Technical Specification Revised revision date11/08/2012 Bases (TSB)

Title PagePalisades TSB Revised to incorporate changes noted below

List of Effective Pages

Editorial change to clarify the TSB for required08/30/2011 Section B 3.3.1 operability for high start-up rate trip and loss of

load trip.

This change was to remove the acronym"CPCo" from the references for engineeringanalyses, and "CPCo" should no longer be

11/08/2012 Section B 3.3.5 included within these references. Thisacronym refers to the Consumers PowerCompany, which is the former owner andoperator of Palisades, and is obsolete.

This change to delete a note that was missedwhen license amendment number 219 was

11/08/2012 Section B 3.3.7 adopted. The reason for the original changewas to align the basis with mode restraintsbeing adopted in accordance with StandardTechnical Specifications (TSTF-359, Rev 9).

This change implements license amendmentnumber 245, which added three TS figures for

02/17/2012 Section B 3.4.3 pressure temperature limits and lowtemperature overpressure curves out to 42.1effective full power years.

This change implements license amendmentnumber 245, which added three TS figures for

02/17/2012 Section B 3.4.12 pressure temperature limits and lowtemperature overpressure curves out to 42.1effective full power years.

This change implements license amendmentnumber 244, which included a revision of the

03/15/2012 Section B 3.6.1 calculated peak containment pressure andrefers to this calculated value along with thesupporting analyses.



Page 1 of 2

ATTACHMENT 1

LIST OF TECHNICAL SPECIFICATIONS BASES CHANGES

Date Affected Bases Change Description







This change implements license amendmentnumber 246. Further, the change included theRegion 1 spent fuel pool criticality analysis thatwas reanalyzed to take into account zero

11/08/2012 Section B 3.7.16 carborundum, a conservative swelling modelof the panels that encapsulate thecarborundum. Additionally, the SFP wateroutside of the fuel assembly envelope wasassumed to be a void. Credit is taken forsoluble boron, depleted fuel, and for burnup.

This TSB was changed to adopt licenseamendment number 242, which relocated thestored diesel fuel oil and lube oil numericalvolume requirements from TS to TSB.

11/08/2012 Section B 3.8.1 Another change was made to modify asentence to correct class 1 E components i.e.,off-site power is not 1 E. The final change wasto clarify which modes Station PowerTransformer 1-2 will not be used to power2400 V safety related buses.

This TSB was changed to adopt licenseamendment number 242 and engineering

09/16/2011 Section B 3.8.3 change EC 12118, which estimates greaterfuel oil consumption for the diesel generatorsat full power.

ATTACHMENT 2

REVISED TECHNICAL SPECIFICATIONS BASES

Page Change Instructions

Title Page

List of Effective Pages

Technical Specification Bases

Section B 3.3.1Section B 3.3.5Section B 3.3.7Section B 3.4.3Section B 3.4.12Section B 3.6.1Section B 3.6.2Section B 3.6.4Section B 3.6.5Section B 3.6.6Section B 3.7.16Section B 3.8.1Section B 3.8.3

147 Pages Follow

Technical Specifications Bases

Page Change Instructions

Revise your copy of the Palisades Technical Specifications Bases by removing the pagesidentified below and inserting the revised pages. Vertical lines in the right-hand margin indicatethe area of change.

REMOVE

Technical Specification BasesTitle Page, Revised 03/15/2012 (1 page)

Palisades Tech Spec BasesList of Effective PagesRevised 03/15/2012 (2 pages)

B 3.3.1-1 through B 3.3.1-35Revised 04/14/11 (35 pages)




B 3.4.12-1 through B 3.4.12-13Revised 04/14/11 (13 Pages)





B 3.6.6-1 through B 3.6.6-13Amendment 227 (13 Pages)

INSERT

Technical Specification BasesTitle Page, Revised 11/08/2012 (1 page)

Palisades Tech Spec BasesList of Effective PagesRevised 11/08/2012 (3 pages)

B 3.3.1-1 through B 3.3.1-35Revised 08/30/2'0011 (35 pages)






B 3.6.2-1 through B 3.6.2-8

Revised 03/15/2012 (8 Pages)




B 3.7.16-1 through B 3.7.16-5Amendment 246, Revised 11/08/2012(5 pages)



B 3.7.16-1 through B 3.7.16-4Amendment 246 (4 pages)



PALISADES PLANT

FACILITY OPERATING LICENSE DPR-20

APPENDIX A

TECHNICAL SPECIFICATIONS

BASES

Revised 11/08/2012

PALISADES TECHNICAL SPECIFICATIONS BASESLIST OF EFFECTIVE PAGES

1

COVERSHEETTitle Page

TABLE OF CONTENTS

Pages i and ii

TECHNICAL SPECIFICATIONS BASES

Bases 2.0

Bases 3.0

Bases 3.1

Pages B 2.1.1-1 -B 2.1.1-4Pages B 2.1.2-1 - B 2.1.2-4

Pages B 3.0-1 - B 3.0-16

Revised 11/08/12

Revised 02/19/09

Revised 04/14/11

189

Revised 02/24/05

189Revised 09/09/03189Revised 07/18/07Revised 07/02/04Revised 07/30/03Revised 05/15/07

Bases 3.2

Bases 3.3

PagesPagesPagesPagesPagesPagesPages

PagesPagesPagesPages

PagesPagesPagesPagesPagesPagesPagesPagesPagesPages

Pages

PagesPagesPagesPagesPagesPagesPagesPagesPagesPages

B 3.1.1-1B 3.1.2-1B 3.1.3-1B 3.1.4-1B 3.1.5-1B 3.1.6-1B 3.1.7-1

BBBB

3.2.1-13.2.2-13.2.3-13.2.4-1

- B 3.1.1-5- B 3.1.2-6- B 3.1.3-4- B 3.1.4-13- B 3.1.5-7- B 3.1.6-9- B 3.1.7-6

- B 3.2.1-11- B 3.2.2-3- B 3.2.3-3- B 3.2.4-3

Bases 3.4

B 3.3.1-1 - B 3.3.1-35B 3.3.2-1 - B 3.3.2-10B 3.3.3-1 - B 3.3.3-24B 3.3.4-1 - B 3.3.4-12B 3.3.5-1 - B 3.3.5-6B 3.3.6-1 - B 3.3.6-6B 3.3.7-1 - B 3.3.7-12B 3.3.8-1 - B 3.3.8-6B 3.3.9-1 - B 3.3.9-5B 3.3.10-1 - B 3.3.10-4

B 3.4.1-1 - B 3.4.1-4B 3.4.2-1 - B 3.4.2-2B 3.4.3-1 - B 3.4.3-7B 3.4.4-1 - B 3.4.4-4B 3.4.5-1 - B 3.4.5-5B 3.4.6-1 - B 3.4.6-6B 3.4.7-1 - B 3.4.7-7B 3.4.8-1 - B 3.4.8-5B 3.4.9-1 - B 3.4.9-6B 3.4.10-1 - B 3.4.10-4B 3.4.11-1 - B 3.4.11-7

Revised 08/06/04Revised 09/28/01Revised 09/28/01189 - Revised 08/09/00

Revised 08/30/2011189- Revised 02/12/01Revised 03/20/08Revised 09/09/03Revised 11/08/2012189 - Revised 02/12/01Revised 11/08/2012Revised 02/24/05189 - Revised 08/09/00189

Revised 08/24/04189Revised 02/17/12Revised 09/21/06Revised 09/21/06Revised 07/31/07Revised 07/31/07Revised 07/31/07189189Revised 02/24/05

Revised 11/08/2012


2

Bases 3.4(Continues)

Bases 3.5

Bases 3.6

Pages

PagesPagesPagesPagesPages

PagesPagePagePagePages

PagesPagesPages

PagesPagesPagesPagesPagesPages

PagesPagesPagesPagesPagesPagesPagesPagesPagesPagesPagesPagesPagesPagesPagesPagesPages

BBBBBB

3.4.12-13.4.13-13.4.14-13.4.15-13.4.16-13.4.17-1

- B 3.4.12-13- B 3.4.13-7- B 3.4.14-8- B 3.4.15-6- B 3.4.16-5- B 3.4.17-7

B 3.5.1-1 - B 3.5.1-5B 3.5.1-6B 3.5.1-7B 3.5.1-8B 3.5.2-1 - B 3.5.2-12B 3.5.3-1 - B 3.5.3-4B 3.5.4-1 - B 3.5.4-7B 3.5.5-1 - B 3.5.5-5

189191189191228Revised 07/22/02227227

Revised 02/17/12Revised 03/20/08189 - Revised 08/09/00Revised 02/24/05Revised 02/24/05223

B 3.6.1-1B 3.6.2-1B 3.6.3-1B 3.6.4-1B 3.6.5-1B 3.6.6-1

- B 3.6.1-4- B 3.6.2-8- B 3.6.3-12- B 3.6.4-3- B 3.6.5-3- B 3.6.6-13

RevisedRevisedRevisedRevisedRevisedRevised

03/15/1203/15/1204/14/1103/15/1203/15/1203/15/12

Bases 3.7 B 3.7.1-1 - B 3.7.1-4B 3.7.2-1 - B 3.7.2-6B 3.7.3-1 - B 3.7.3-5B 3.7.4-1 - B 3.7.4-4B 3.7.5-1 - B 3.7.5-9B 3.7.6-1 - B 3.7.6-4B 3.7.7-1 - B 3.7.7-9B 3.7.8-1 - B 3.7.8-8B 3.7.9-1 - B 3.7.9-3B 3.7.10-1 - B 3.7.10-8B 3.7.11-1 - B 3.7.11-5B 3.7.12-1 - B 3.7.12-7B 3.7.13-1 - B 3.7.13-3B 3.7.14-1 - B 3.7.14-3B 3.7.15-1 - B 3.7.15-2B 3.7.16-1 - B 3.7.16-5B 3.7.17-1 - B 3.7:17-3

Revised 08/06/04Revised 12/02/02Revised 12/02/02Revised 07/16/08Revised 02/24/05Revised 04/14/11Revised 06/07/05Revised 10/29/09Revised 04/14/11230189Revised 07/16/03189 - Revised 08/09/00Revised 09/09/03236246 - Revised 11/08/12Revised 04/14/11

Revised 11/08/2012


3

Bases 3.8 PagesPagesPagesPagesPagesPagesPagesPagesPages

Pages

PagesPagesPagesPagesPagesPages

B 3.8.1-1 - B 3.8.1-24B 3.8.2-1 - B 3.8.2-4B 3.8.3-1 - B 3.8.3-7B 3.8.4-1 - B 3.8.4-9B 3.8.5-1 - B 3.8.5-3B 3.8.6-1 - B 3.8.6-6B 3.8.7-1 - B 3.8.7-3B 3.8.8-1 - B 3.8.8-3B 3.8.9-1 - B 3.8.9-7B 3.8.10-1 - B 3.8.10-3

Revised 11/08/12Revised 11/06/01Revised 09/16/11Revised 07/13/06Revised 11/06/01189 - Revised 08/09/00189Revised 11/06/01Revised 11/06/01Revised 11/06/01

189 - Revised 08/09/00189 - Revised 02/12/01189 - Revised 08/09/00Revised 07/31/07Revised 07/31/07189 - Revised 02/27/01

Bases 3.9 B 3.9.1-1B 3.9.2-1B 3.9.3-1B 3.9.4-1B 3.9.5-1B 3.9.6-1

- B 3.9.1-4- B 3.9.2-3- B 3.9.3-6- B 3.9.4-4- B 3.9.5-4- B 3.9.6-3

Revised 11/08/2012

RPS InstrumentationB 3.3.1

B 3.3 INSTRUMENTATION

B 3.3.1 Reactor Protective System (RPS) Instrumentation

BASES

BACKGROUND The RPS initiates a reactor trip to protect against violating theacceptable fuel design limits and breaching the reactor coolant pressureboundary during Anticipated Operational Occurrences (AOOs). (Asdefined in 10 CFR 50, Appendix A, "Anticipated operationaloccurrences mean those conditions of normal operation which areexpected to occur one or more times during the life of the nuclear powerunit and include but are not limited to loss of power to all recirculationpumps, tripping of the turbine generator set, isolation of the maincondenser, and loss of all offsite power.") By tripping the reactor, theRPS also assists the Engineered Safety Features (ESF) systems inmitigating accidents.

The protection and monitoring systems have been designed to ensuresafe operation of the reactor. This is achieved by specifying LimitingSafety System Settings (LSSS) in terms of parameters directlymonitored by the RPS, as well as LCOs on other reactor systemparameters and equipment performance.

The LSSS, defined in this Specification as the Allowable Values, inconjunction with the LCOs, establish the threshold for protective systemaction to prevent exceeding acceptable limits during Design BasisAccidents (DBAs).

During AOOs, which are those events expected to occur one or moretimes during the plant life, the acceptable limits are:

" The Departure from Nucleate Boiling Ratio (DNBR) shall bemaintained above the Safety Limit (SL) value to prevent departurefrom nucleate boiling;

* Fuel centerline melting shall not occur; and

" The Primary Coolant System (PCS) pressure SL of 2750 psiashall not be exceeded.

Maintaining the parameters within the above values ensures that theoffsite dose will be within the 10 CFR 50 (Ref. 1) and 10 CFR 100(Ref. 2) criteria during AOOs.

Palisades Nuclear Plant B 3.3.1 -1 Revised 08/30/2011


BASES

BACKGROUND Accidents are events that are analyzed even though they are not(continued) expected to occur during the plant life. The acceptable limit during

accidents is that the offsite dose shall be maintained within anacceptable fraction of 10 CFR 100 (Ref. 2) limits. Different accidentcategories allow a different fraction of these limits based on probabilityof occurrence. Meeting the acceptable dose limit for an accidentcategory is considered having acceptable! consequences for that event.

The RPS is segmented into four interconnected modules. Thesemodules are:

" Measurement channels;

" RPS trip units;

* Matrix Logic; and

* Trip Initiation Logic.

This LCO addresses measurement channels and RPS trip units. It alsoaddresses the automatic bypass removal feature for those trips withZero Power Mode bypasses. The RPS Logic and Trip Initiation Logicare addressed in LCO 3.3.2, "Reactor Protective System (RPS) Logicand Trip Initiation." The role of the measurement channels, RPS tripunits, and RPS Bypasses is discussed below.

Measurement Channels

Measurement channels, consisting of pressure switches, fieldtransmitters, or process sensors and associated instrumentation,provide a measurable electronic signal based upon the physicalcharacteristics of the parameter being measured.

With the exception of High Startup Rate, which employs two instrumentchannels, and Loss of Load, which employs a single pressure sensor,four identical measurement channels with electrical and physicalseparation are provided for each parameter used in the directgeneration of trip signals. These are designated channels A through D.Some measurement channels provide input to more than one RPS tripunit within the same RPS channel. In addition, some measurementchannels may also be used as inputs to Engineered Safety Features(ESF) bistables, and most provide indication in the control room.

Palisades Nuclear Plant B 3.3.1-2 Revised 08/30/2011


BASES

BACKGROUND Measurement Channels (continued)(continued)

In the case of High Startup Rate and Loss of Load, where fewer thanfour sensor channels are employed, the reactor trips provided are notrelied upon by the plant safety analyses. The sensor channels dohowever, provide trip input signals to all four RPS channels.

When a channel monitoring a parameter exceeds a predeterminedsetpoint, indicating an abnormal condition, the bistable monitoring theparameter in that channel will trip. Tripping two or more channels ofbistable trip units monitoring the same parameter de-energizes MatrixLogic, (addressed by LCO 3.3.2) which in turn de-energizes the TripInitiation Logic. This causes all four DC clutch power supplies tode-energize, interrupting power to the control rod drive mechanismclutches, allowing the full length control rods to insert into the core.

For those trips relied upon in the safety analyses, three of the fourmeasurement and trip unit channels can meet the redundancy andtestability of GDC 21 in 10 CFR 50, Appendix A (Ref. 1). This LCOrequires, however, that four channels be OPERABLE. The fourthchannel provides additional flexibility by allowing one channel to beremoved from service (trip channel bypassed) for maintenance ortesting while still maintaining a minimum two-out-of-three logic.

I

Since no single failure will prevent a protective system actuation, thisarrangement meets the requirements of IEEE Standard 279-1971(Ref. 3).

Most of the RPS trips are generated by comparing a singlemeasurement to a fixed bistable setpoint. Two trip Functions, VariableHigh Power Trip and Thermal Margin Low Pressure Trip, make use ofmore than one measurement to provide a trip.

The required RPS Trip Functions utilize the following inputinstrumentation:

Variable Higqh Power Trip (VHPT)

The VHPT uses Q Power as its input. Q Power is the higher of NIpower from the power range NI drawer and primary calorimetricpower (AT power) based on PCS hot leg and cold legtemperatures. The measurement channels associated with theVHPT are the power range excore channels, and the PCS hot andcold leg temperature channels.



BASES

BACKGROUND Measurement Channels(continued)

" Variable Hicqh Power Trip (VHPT) (continued)

The Thermal Margin Monitors provide the complex signalprocessing necessary to calculate the TM/LP trip setpoint, VHPTtrip setpoint and trip comparison, and Q Power calculation. Onpower decreases the VHPT setpoint tracks power levelsdownward so that it is always within a fixed increment abovecurrent power, subject to a minimum value.

On power increases, the trip setpoint remains fixed unlessmanually reset, at which point it increases to the new setpoint, afixed increment above Q Power at the time of reset, subject to amaximum value. Thus, during power escalation, the trip setpointmust be repeatedly reset to avoid a reactor trip.

* Higqh Startup Rate Trip

The High Startup Rate trip uses the wide range NuclearInstruments (NIs) to provide an input signal. There are only twowide range NI channels. The wide range channel signalprocessing electronics are physically mounted in RPS cabinetchannels C (N1-1/3) and D (NI-2/4). Separate bistable trip unitsmounted within the N1-1/3 wide range channel drawer supply HighStartup Rate trip signals to RPS channels A and C. Separatebistable trip units mounted within the NI-2/4 wide range channeldrawer provide High Startup Rate trip signals to RPS channels Band D.

Low Primary Coolant Flow Trip

The Low Primary Coolant Flow Trip utilizes 16 flow measurementchannels which monitor the differential pressure across theprimary side of the steam generators. Each RPS channel, A, B,C, and D, receives a signal which is the sum of four differentialpressure signals. This totalized signal is compared with a setpointin the RPS Low Flow bistable trip unit for that RPS channel.



BASES


* Low Steam Generator Level Trips

There are two separate Low Steam Generator Level trips, one foreach steam generator. Each Low Steam Generator Level tripmonitors four level measurement channels for the associatedsteam generator, one for each RPS channel.

" Low Steam Generator Pressure Trips

There are also two separate Low Steam Generator Pressure trips,one for each steam generator. Each Low Steam GeneratorPressure trip monitors four pressure measurement channels forthe associated steam generator, one for each RPS channel.

* High Pressurizer Pressure Trip

The High Pressurizer Pressure Trip monitors four pressurizerpressure channels, one for each RPS channel.

* Thermal Margin Low Pressure (TM/LP) Trip

The TM/LP Trip utilizes bistable trip units. Each of these bistabletrip units receives a calculated trip setpoint from the ThermalMargin Monitor (TMM) and compares it to the measuredpressurizer pressure signal. The TM/LP setpoint is based onQ power (the higher of NI power from the power range NI drawer,or AT power, based on PCS hot leg and cold leg temperatures)pressurizer pressure, PCS cold leg temperature, and Axial ShapeIndex. The TMM provide the complex signal processingnecessary to calculate the TM/LP trip setpoint, TM/LP tripcomparison signal, and Q Power.



BASES


" Loss of Load Trip

The Loss of Load Trip is initiated by two-out-of-three logic frompressure switches in the turbine auto stop oil circuit that sense aturbine trip for input to all four RPS auxiliary trip units. The Loss ofLoad Trip is actuated by turbine auxiliary relays 305L and 305R.Relay 305L provides input to RPS channels A and C; 305R tochannels B and D. Relays 305L and 305R are energized on aturbine trip. Their inputs are the same as the inputs to the turbinesolenoid trip valve, 20ET.

If a turbine trip is generated by loss of auto stop oil pressure, theauto stop oil pressure switches, by two-out-of-three logic, willactuate relays 305L and 305R and generate a reactor trip. If aturbine trip is generated by an input to the solenoid trip valve,relays 305L and 305R, which are wired in parallel, will also beactuated and will generate a reactor trip.

" Containment High Pressure Trip

The Containment High Pressure Trip is actuated by four pressureswitches, one for each RPS channel.

* Zero Power Mode Bypass Automatic Removal

The Zero Power Bypass allows manually bypassing(i.e., disabling) four reactor trip functions, Low PCS Flow, Low SGA Pressure, Low SG B Pressure, and TM/LP (low PCS pressure),when reactor power (as indicated by the wide range nuclearinstrument channels) is below 10-4%. This bypassing is necessaryto allow RPS testing and control rod drive mechanism testingwhen the reactor is shutdown and plant conditions would cause areactor trip to be present.

The Zero Power Mode Bypass removal interlock uses the widerange nuclear instruments (NIs) as measurement channels.There are only two wide range NI channels. Separate bistablesare provided to actuate the bypass removal for each RPSchannel. Bistables in the NI-1/3 channel provide the bypassremoval function for RPS channels A and C; bistables in theNI-2/4 channel for RPS channels B and D.



BASES

BACKGROUND Several measurement instrument channels provide more than one(continued) required function. Those sensors shared for RPS and ESF functions

are identified in Table B 3.3.1-1. That table provides a listing of thoseshared channels and the Specifications which they affect.

RPS Trip Units

Two types of RPS trip units are used in the RPS cabinets; bistable tripunits and auxiliary trip units:

A bistable trip unit receives a measured process signal from itsinstrument channel and compares it to a setpoint; the trip unitactuates three relays, with contacts in the Matrix Logic channels,when the measured signal is less conservative than the setpoint.They also provide local trip indication and remote annunciation.

An auxiliary trip unit receives a digital input (contacts open orclosed); the trip unit actuates three relays, with contacts in theMatrix Logic channels, when the digital input is received. Theyalso provide local trip indication and remote annunciation.

Each RPS channel has four auxiliary trip units and seven bistable tripunits.

The contacts from these trip unit relays are arranged into sixcoincidence matrices, comprising the Matrix Logic. If bistable trip unitsmonitoring the same parameter in at least two channels trip, the MatrixLogic will generate a reactor trip (two-out-of-four logic).

Four of the RPS measurement channels provide contact outputs to theRPS, so the comparison of an analog input to a trip setpoint is notnecessary. In these cases, the bistable trip unit is replaced with anauxiliary trip unit. The auxiliary trip units provide contact multiplicationso the single input contact opening can provide multiple contact outputsto the coincidence logic as well as trip indication and annunciation.



BASES

BACKGROUND RPS Trip Units (continued)(continued)

Trips employing auxiliary trip units include the VHPT, which receivescontact inputs from the Thermal Margin Monitors; the High Startup Ratetrip which employs contact inputs from bistables mounted in the twowide range drawers; the Loss of Load Trip which receives contactinputs from one of two auxiliary relays which are operated by two-out-of-three logic switches sensing turbine auto stop oil pressure; and theContainment High Pressure (CHP) trip, which employs containmentpressure switch contacts.

There are four RPS trip units, designated as channels A through D,each channel having eleven trip units, one for each RPS Function. Tripunit output relays de-energize when a trip occurs.

All RPS Trip Functions, with the exception of the Loss of Load and CHPtrips, generate a pretrip alarm as the trip setpoint is approached.

The Allowable Values are specified for each safety related RPS tripFunction which is credited in the safety analysis. Nominal trip setpointsare specified in the plant procedures. The nominal setpoints areselected to ensure plant parameters do not exceed the Allowable Valueif the instrument loop is performing as required. The methodology usedto determine the nominal trip setpoints is also provided in plantdocuments. Operation with a trip setpoint less conservative than thenominal trip setpoint, but within its Allowable Value, is acceptable. EachAllowable Value specified is more conservative than the analytical limitdetermined in the safety analysis in order to account for uncertaintiesappropriate to the trip Function. These uncertainties are addressed asdescribed in plant documents. A channel is inoperable if its actualsetpoint is not within its Allowable Value.

Setpoints in accordance with the Allowable Value will ensure that SLs ofChapter 2.0 are not violated during AOOs and the consequences ofDBAs will be acceptable, providing the plant is operated from within theLCOs at the onset of the AOO or DBA and the equipment functions asdesigned.

Note that in the accompanying LCO 3.3.1, the Allowable Values ofTable 3.3.1-1 are the LSSS.



BASES

BACKGROUND Reactor Protective System Bypasses(continued)

Three different types of trip bypass are utilized in the RPS, OperatingBypass, Zero Power Mode Bypass, and Trip Channel Bypass. TheOperating Bypass or Zero Power Mode Bypass prevent the actuation ofa trip unit or auxiliary trip unit; the Trip Channel Bypass prevents the tripunit output from affecting the Logic Matrix. A channel which isbypassed, other than as allowed by the Table 3.3.1-1 footnotes, cannotperform its specified safety function and must be considered to beinoperable.

Operating Bypasses

The Operating Bypasses are initiated and removed automatically duringstartup and shutdown as power level changes. An Operating Bypassprevents the associated RPS auxiliary trip unit from receiving a tripsignal from the associated measurement channel. With the bypass inplace, neither the pre-trip alarm nor the trip will actuate if the measuredparameter exceeds the set point. An annunciator is provided for eachOperating Bypass. The RPS trips with Operating Bypasses are:

a. High Startup Rate Trip bypass. The High Startup Rate trip isautomatically bypassed when the associated wide range channelindicates below 1 E-4% RTP, and when the associated powerrange excore channel indicates above 13% RTP. Thesebypasses are automatically removed between 1 E-4% RTP and13% RTP.

b. Loss of Load bypass. The Loss of Load trip is automaticallybypassed when the associated power range excore channelindicates below 17% RTP. The bypass is automatically removedwhen the channel indicates above the set point. The same powerrange excore channel bistable is used to bypass the High StartupRate trip and the Loss of Load trip for that RPS channel.



BASES

BACKGROUND Operating Bypasses (continued)(continued)

Each wide range channel contains two bistables set at 1 E-4% RTP, onebistable unit for each associated RPS channel. Each of the two widerange channels affect the Operating Bypasses for two RPS channels;wide range channel N1-1/3 for RPS channels A and C, wide rangechannel NI-2/4 for RPS channels B and D. Each of the four powerrange excore channel affects the Operating Bypasses for theassociated RPS channel. The power range excore channel bistablesassociated with the Operating Bypasses are set at a nominal 15%, andare required to actuate between 13% RTP and 17% RTP.

Zero Power Mode (ZPM) Bypass

The ZPM Bypass is used when the plant is shut down and it is desiredto raise the control rods for control rod drop testing with PCS flow,pressure or temperature too low for the RPS trips to be reset. ZPMbypasses may be manually initiated and removed when wide rangepower is below 1 E-4% RTP, and are automatically removed if theassociated wide range NI indicated power exceeds 1 E-4% RTP. AZPM bypass prevents the RPS trip unit from actuating if the measuredparameter exceeds the set point. Operation of the pretrip alarm isunaffected by the zero power mode bypass. An annunciator indicatesthe presence of any ZPM bypass. The RPS trips with ZPM bypassesare:

a. Low Primary Coolant System Flow.

b. Low Steam Generator Pressure.

c. Thermal Margin/Low Pressure.

The wide range NI channels provide contact closure permissive signalswhen indicated power is below 1 E-4% RTP. The ZPM bypasses maythen be manually initiated or removed by actuation of key-lock switches.One key-lock switch located on each RPS cabinet controls the ZPM

Bypass for the associated RPS trip channels. The bypass isautomatically removed if the associated wide range NI indicated powerexceeds 1 E-4% RTP. The same wide range NI channel bistables thatprovide the ZPM Bypass permissive and removal signals also providethe high startup rate trip Operating Bypass actuation and removal.



BASES

BACKGROUND(continued)

Trip Channel Bypass

A Trip Channel Bypass is used when it is desired to physically removean individual trip unit from the system, or when calibration or servicingof a trip channel could cause an inadvertent trip. A trip Channel Bypassmay be manually initiated or removed at any time by actuation of a key-lock switch. A Trip Channel Bypass prevents the trip unit output fromaffecting the RPS logic matrix. A light above the bypass switchindicates that the trip channel has been bypassed. Each RPS trip unithas an associated trip channel bypass:

The key-lock trip channel bypass switch is located above each trip unit.The key cannot be removed when in the bypass position. Only one key

for each trip parameter is provided, therefore the operator can bypassonly one channel of a given parameter at a time. During the bypasscondition, system logic changes from two-out-of-four to two-out-of-threechannels required for trip.

APPLICABLESAFETY ANALYSES

Each of the analyzed accidents and transients can be detected by oneor more RPS Functions. The accident analysis contained inReference 4 takes credit for most RPS trip Functions. The High StartupRate and Loss of Load Functions, which are not specifically credited inthe accident analysis, are part of the NRC approved licensing basis forthe plant, and are required to be operable in accordance with theirrespective LCO. The High Startup Rate and Loss of Load trips arepurely equipment protective, and their use minimizes the potential forequipment damage.

The specific safety analyses applicable to each protective Function areidentified below.

1. Variable High Power Trip (VHPT)

The VHPT provides reactor core protection against positivereactivity excursions.

The safety analysis assumes that this trip is OPERABLE toterminate excessive positive reactivity insertions during poweroperation and while shut down.



BASES

APPLICABLESAFETY ANALYSIS

(continued)

2. High Startup Rate Trip

There are no safety analyses which take credit for functioning ofthe High Startup Rate Trip. The High Startup Rate trip is used totrip the reactor when excore wide range power indicates anexcessive rate of change. The High Startup Rate trip minimizestransients for events such as a continuous control rod withdrawalor a boron dilution event from low power levels. The trip may beoperationally bypassed when THERMAL POWER is< 1 E-4% RTP, when poor counting statistics may lead toerroneous indication. It may also be operationally bypassed at> 13% RTP, where moderator temperature coefficient and fueltemperature coefficient make high rate of change of powerunlikely.

There are only two wide range drawers, with each supplyingcontact input to auxiliary trip units in two RPS channels.

3. Low Primary Coolant System Flow Trip

The Low PCS Flow trip provides DNB protection during eventswhich suddenly reduce the PCS flow rate during power operation,such as loss of power to, or seizure of, a primary coolant pump.

Flow in each of the four PCS loops is determined from pressuredrop from inlet to outlet of the SGs. The total PCS flow isdetermined, for the RPS flow channels, by summing the looppressure drops across the SGs and correlating this pressure sumwith the sum of SG differential pressures which exist at 100% flow(four pump operation at full power Tve). Full PCS flow is that flowwhich exists at RTP, at full power Tave, with four pumps operating.

4, 5. Low Steam Generator Level Trip

The Low Steam Generator Level trips are provided to trip thereactor in the event of excessive steam demand (to preventovercooling the PCS) and loss of feedwater events (to preventoverpressurization of the PCS).

The Allowable Value assures that there will be sufficient waterinventory in the SG at the time of trip to allow a safe and orderlyplant shutdown and to prevent SG dryout assuming minimumAFW capacity.



BASES

APPLICABLE 4, 5. Low Steam Generator Level Trip (continued)SAFETY ANALYSIS(continued) Each SG level is sensed by measuring the differential pressure in

the upper portion of the downcomer annulus in the SG. Thesetrips share four level sensing channels on each SG with the AFWactuation signal.

6, 7. Low Steam Generator Pressure Trip

The Low Steam Generator Pressure trip provides protectionagainst an excessive rate of heat extraction from the steamgenerators, which would result in a rapid uncontrolled cooldown ofthe PCS. This trip provides a mitigation function in the event of anMSLB.

The Low SG Pressure channels are shared with the Low SGPressure signals which isolate the steam and feedwater lines.

8. High Pressurizer Pressure Trip

The High Pressurizer Pressure trip, in conjunction with pressurizersafety valves and Main Steam Safety Valves (MSSVs), providesprotection against overpressure conditions in the PCS when atoperating temperature. The safety analyses assume the HighPressurizer Pressure trip is OPERA13LE during accidents andtransients which suddenly reduce PCS cooling (e.g., Loss of Load,Main Steam Isolation Valve (MSIV) closure, etc.) or whichsuddenly increase reactor power (e.g., rod ejection accident).

The High Pressurizer Pressure trip shares four safety gradeinstrument channels with the TM/LP trip, Anticipated TransientWithout Scram (ATWS) and PORV circuits, and the PressurizerLow Pressure Safety Injection Signal.



BASES

APPLICABLE 9. Thermal Margin/Low Pressure (TM/LP) TripSAFETY ANALYSIS

(continued) The TM/LP trip is provided to prevent reactor operation when theDNBR is insufficient. The TM/LP trip protects against slowreactivity or temperature increases, and against pressuredecreases.

The trip is initiated whenever the PCS pressure signal dropsbelow a minimum value (Pmin) or a computed value (Pvar) asdescribed below, whichever is higher.

The TM/LP trip uses Q Power, ASI, pressurizer pressure, and coldleg temperature (Tc) as inputs.

Q Power is the higher of core THERMAL POWER (AT Power) ornuclear power. The AT power uses hot leg and cold leg RTDs asinputs. Nuclear power uses the power range excore channels asinputs. Both the AT and excore power signals have provisions forcalibration by calorimetric calculations.

The ASI is calculated from the upper and lower power rangeexcore detector signals, as explained in Section 1.1, "Definitions."The signal is corrected for the difference between the flux at the

core periphery and the flux at the detectors.

The Tc value is the higher of the two cold leg signals.

The Low Pressurizer Pressure trip limit (Pvar)iS calculated usingthe equations given in Table 3.3.1-2.

The calculated limit (Pwar) is then compared to a fixed LowPressurizer Pressure trip limit (Pmin). The auctioneered highest ofthese signals becomes the trip limit (Ptrip). Ptrip is compared to themeasured PCS pressure and a trip signal is generated when themeasured pressure for that channel is less than or equal to Ptrip.A pre-trip alarm is also generated when P is less than or equal tothe pre-trip setting, Ptrip + AP.

The TM/LP trip setpoint is a complex function of these inputs andrepresents a minimum acceptable PCS pressure for the existingtemperature and power conditions. It is compared to actual PCSpressure in the TM/LP trip unit.



BASES

APPLICABLE 10. Loss of Load TripSAFETY ANALYSIS

(continued) There are no safety analyses which take credit for functioning ofthe Loss of Load Trip.

The Loss of Load trip is provided to prevent lifting the pressurizerand main steam safety valves in the event of a turbine generatortrip while at power. The trip is equipment protective. The safetyanalyses do not assume that this trip functions during anyaccident or transient. The Loss of Load trip uses two-out-of-threelogic from pressure switches in the turbine auto stop oil circuit tosense a turbine trip for input to all four RPS auxiliary trip units.

11. Containment High Pressure Trip

The Containment High Pressure trip provides a reactor trip in theevent of a Loss of Coolant Accident (LOCA) or Main Steam LineBreak (MSLB). The Containment High Pressure trip sharessensors with the Containment High Pressure sensing logic forSafety Injection, Containment Isolation, and Containment Spray.Each of these sensors has a single bellows which actuates twomicroswitches. One microswitch on each of four sensors providesan input to the RPS.

12. Zero Power Mode Bypass Removal

The only RPS bypass considered in the safety analyses is theZero Power Mode (ZPM) Bypass. The ZPM Bypass is used whenthe plant is shut down and it is desired to raise the control rods forcontrol rod drop testing with PCS flow or temperature too low forthe RPS Low PCS Flow, Low SG Pressure, or ThermalMargin/Low Pressure trips to be reset. ZPM bypasses areautomatically removed if the wide range NI indicated powerexceeds 1E-4% RTP.



BASES

APPLICABLESAFETY ANALYSIS

(continued)

12. Zero Power Mode Bypass Removal (continued)

The safety analyses take credit for automatic removal of the ZPMBypass if reactor criticality due to a Continuous Control Rod BankWithdrawal should occur with the affected trips bypassed andPCS flow, pressure, or temperature below the values at which theRPS could be reset. The ZPM Bypass would effectively beremoved when the first wide range NI channel indication reached1 E-4% RTP. With the ZPM Bypass for two RPS channelsremoved, the RPS would trip on one of the un-bypassed trips.This would prevent the reactor reaching an excessive power level.

If a reactor criticality due to a Continuous Control Rod BankWithdrawal should occur when PCS flow, steam generatorpressure, and PCS pressure (TM/LP) were above their tripsetpoints, a trip would terminate the event when power increasedto the minimum setting (nominally 30%) of the Variable HighPower Trip. In this case, the monitored parameters are at or neartheir normal operational values, and a trip initiated at 30% RTPprovides adequate protection.

The RPS design also includes automatic removal of the OperatingBypasses for the High Startup Rate and Loss of Load trips. Thesafety analyses do not assume functioning of either these trips orthe automatic removal of their bypasses.

The RPS instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2).

LCO The LCO requires all instrumentation performing an RPS Function to beOPERABLE. Failure of the trip unit (including its output relays), anyrequired portion of the associated instrument channel, or both, rendersthe affected channel(s) inoperable and reduces the reliability of theaffected Functions. Failure of an automatic ZPM bypass removalchannel may also impact the associated instrument channel(s) andreduce the reliability of the affected Functions.



BASES

LCO(continued)

Actions allow Trip Channel Bypass of individual channels, but thebypassed channel must be considered to be inoperable. The bypasskey used to bypass a single channel cannot be simultaneously used tobypass that same parameter in other channels. This interlock preventsoperation with more than one channel of the same Function trip channelbypassed. The plant is normally restricted to 7 days in a trip channelbypass, or otherwise inoperable condition before either restoring theFunction to four channel operation (two-out-of-four logic) or placing thechannel in trip (one-out-of-three logic).

The Allowable Values are specified for each safety related RPS tripFunction which is credited in the safety analysis. Nominal trip setpointsare specified in the plant procedures. The nominal setpoints areselected to ensure plant parameters do not exceed the Allowable Valueif the instrument loop is performing as required. Operation with a tripsetpoint less conservative than the nominal trip setpoint, but within itsAllowable Value, is acceptable. Each Allowable Value specified is moreconservative than the analytical limit determined in the safety analysis inorder to account for uncertainties appropriate to the trip Function.These uncertainties are addressed as described in plant document,.Neither Allowable Values nor setpoints are specified for the non-safetyrelated RPS Trip Functions, since no safety analysis assumptions wouldbe violated if they are not set at a particular value.

The following Bases for each trip Function identify the above RPS tripFunction criteria items that are applicable to establish the trip FunctionOPERABILITY.

1. Variable High Power Trip (VHPT)

This LCO requires all four channels of the VHPT Function to beOPERABLE.

The Allowable Value is high enough to provide an operatingenvelope that prevents unnecessary VHPT trips during normalplant operations. The Allowable Value is low enough for thesystem to function adequately during reactivity addition events.



BASES

LCO 1. Variable High Power Trip (VHPT) (continued)(continued)

The VHPT is designed to limit maximum reactor power to itsmaximum design and to terminate power excursions initiating atlower powers without power reaching this full power limit. Duringplant startup, the VHPT trip setpoint is initially at its minimumvalue, < 30%. Below 30% RTP, the VHPT setpoint is not requiredto "track" with Q Power, i.e., be adjusted to within 15% RTP. Itremains fixed until manually reset, at which point it increases to< 15% above existing Q Power.

The maximum allowable setting of the VHPT is 109.4% RTP.Adding to this the possible variation in trip setpoint due tocalibration and instrument error, the maximum actual steady statepower at which a trip would be actuated is 113.4%, which is thevalue assumed in the safety analysis.

2. High Startup Rate Trip

This LCO requires four channels of High Startup Rate TripFunction to be OPERABLE in MODES 1 and 2.

The High Startup Rate trip serves as a backup to theadministratively enforced startup rate limit. The Function is notcredited in the accident analyses; therefore, no Allowable Valuefor the trip or operating bypass Functions is derived fromanalytical limits and none is specified.

The High Startup Rate Trip is required to be OPERABLE, inaccordance with the LCO, even though the Trip Function is notcredited in the accident analysis.

The four channels of the High Startup Rate trip are derived fromtwo wide range NI signal processing drawers. Thus, a failure inone wide range channel could render two RPS channelsinoperable. It is acceptable to continue operation in this conditionbecause the High Startup Rate trip is not credited in any safetyanalyses.

The requirement for this trip Function is modified by a footnote,which allows the High Startup Rate trip to be bypassed when thewide range NI indicates below 1OE-4% or when THERMALPOWER is above 13% RTP. If a High Startup Rate trip isbypassed when power is between these limits, it must beconsidered to be inoperable.



BASES

LCO 3. Low Primary Coolant System Flow Trip(continued)

This LCO requires four channels of Low PCS Flow Trip Functionto be OPERABLE.

This trip is set high enough to maintain fuel integrity during a lossof flow condition. The setting is low enough to allow for normaloperating fluctuations from offsite power.

The Low PCS Flow trip setpoint of 95% of full PCS flow insuresthat the reactor cannot operate when the flow rate is less than93% of the nominal value considering instrument errors. Full PCSflow is that flow which exists at RTP, at full power Tave, with fourpumps operating.

The requirement for this trip Function is modified by a footnote,which allows use of the ZPM bypass when wide range power isbelow 1 E-4% RTP. That bypass is automatically removed whenthe associated wide range channel indicates 1 E-4% RTP. If a tripchannel is bypassed when power is above 1 E-4% RTP, it must beconsidered to be inoperable.

4, 5. Low Steam Generator Level Trip

This LCO requires four channels of Low Steam Generator LevelTrip Function per steam generator to be OPERABLE.

The 25.9% Allowable Value assures that there is an adequatewater inventory in the steam generators when the reactor is criticaland is based upon narrow range instrumentation. The 25.9%indicated level corresponds to the location of the feed ring.

6, 7. Low Steam Generator Pressure Trip

This LCO requires four channels of Low Steam GeneratorPressure Trip Function per steam generator to be OPERABLE.

The Allowable Value of 500 psia is sufficiently below the full loadoperating value for steam pressure so as not to interfere withnormal plant operation, but still high enough to provide therequired protection in the event of excessive steam demand.Since excessive steam demand causes the PCS to cool down,resulting in positive reactivity addition to the core, a reactor trip isrequired to offset that effect.



BASES

LCO(continued) 8. High Pressurizer Pressure Trip

This LCO requires four channels of High Pressurizer PressureTrip Function to be OPERABLE.

The Allowable Value is set high enough to allow for pressureincreases in the PCS during normal operation (i.e., planttransients) not indicative of an abnormal condition. The setting isbelow the lift setpoint of the pressurizer safety valves and lowenough to initiate a reactor trip when an abnormal condition isindicated.

9. Thermal Margin/Low Pressure (TM/IP) Trip

This LCO requires four channels of TM/LP Trip Function to beOPERABLE.

The TM/LP trip setpoints are derived from the core thermal limitsthrough application of appropriate allowances for measurementuncertainties and processing errors. The allowances specificallyaccount for instrument drift in both power and inlet temperatures,calorimetric power measurement, inlet temperature measurement,and primary system pressure measurement.

Other uncertainties including allowances for assembly power tilt,fuel pellet manufacturing tolerances, core flow measurementuncertainty and core bypass flow, inlet temperature measurementtime delays, and ASI measurement, are included in thedevelopment of the TM/LP trip setpoint used in the accidentanalysis.

The requirement for this trip Function is modified by a footnote,which allows use of the ZPM bypass when wide range power isbelow 1E-4% RTP. That bypass is automatically removed whenthe associated wide range channel indicates 1 E-4% RTP. If a tripchannel is bypassed when power is above 1E-4% RTP, it must beconsidered to be inoperable.



BASES

LCO 10. Loss of Load Trip(continued)

The LCO requires four Loss of Load Trip Function channels to beOPERABLE in MODE 1 with THERMAL POWER > 17% RTP.

The Loss of Load trip may be bypassed or be inoperable withTHERMAL POWER < 17% RTP, since it is no longer needed toprevent lifting of the pressurizer safety valves or steam generatorsafety valves in the event of a Loss of Load. Loss of Load Tripunit must be considered inoperable if it is bypassed whenTHERMAL POWER is above 17% RTP.

This LCO requires four RPS Loss of Load auxiliary trip units,relays 305L and 305R, and pressure switches 63/AST-1,63/AST-2, and 63/AST-3 to be OPERABLE. With thosecomponents OPERABLE, a turbine trip will generate a reactor trip.The LCO does not require the various turbine trips, themselves,

to be OPERABLE.

The Nuclear Steam Supply System and Steam Dump System arecapable of accommodating the Loss of Load without requiring theuse of the above equipment.

The Loss of Load Trip Function is not credited in the accidentanalysis; therefore, an Allowable Value for the trip cannot bederived from analytical limits, and is not specified.

The Loss of Load Trip is required to be OPERABLE, inaccordance with the LCO, even though the Trip Function is notcredited in the accident analysis.

11. Containment High Pressure Trip

This LCO requires four channels of Containment High PressureTrip Function to be OPERABLE.

The Allowable Value is high enough to allow for small pressureincreases in containment expected during normal operation(i.e., plant heatup) that are not indicative of an abnormal condition.The setting is low enough to initiate a reactor trip to prevent

containment pressure from exceeding design pressure following aDBA and ensures the reactor is shutdown before initiation ofsafety injection and containment spray.



BASES

LCO(continued) 12. ZPM Bypass

The LCO requires that four channels of automatic Zero PowerMode (ZPM) Bypass removal instrumentation be OPERABLE.Each channel of automatic ZPM Bypass removal includes ashared wide range NI channel, an actuating bistable in the widerange drawer, and a relay in the associated RPS cabinet. WideRange NI channel 1/3 is shared between ZPM Bypass removalchannels A and C; Wide Range NI channel 2/4, between ZPMBypass removal channels B and D. An operable bypass removalchannel must be capable of automatically removing the capabilityto bypass the affected RPS trip channels with the ZPM Bypasskey switch at the proper setpoint.

APPLICABILITY This LCO requires all safety related trip functions to be OPERABLE inaccordance with Table 3.3.1-1.

Those RPS trip Functions which are assumed in the safety analyses(all except High Startup Rate and Loss of Load), are required to beoperable in MODES 1 and 2, and in MODES 3, 4, and 5 with more thanone full-length control rod capable of being withdrawn and PCS boronconcentration less than REFUELING BORON CONCENTRATION.

These trip Functions are not required while in MODES 3, 4, or 5, if PCSboron concentration is at REFUELING BORON CONCENTRATION, orwhen no more than one full-length control rod is capable of beingwithdrawn, because the RPS Function is already fulfilled. REFUELINGBORON CONCENTRATION provides sufficient negative reactivity toassure the reactor remains subcritical regardless of control rod position,and the safety analyses assume that the highest worth withdrawnfull-length control rod will fail to insert on a trip. Therefore, under theseconditions, the safety analyses assumptions will be met without theRPS trip Function. j

The High Startup Rate Trip Function is required to be OPERABLE inMODES 1 and 2, but may be bypassed when the associated wide rangeNI channel indicates below 1E-4% power, when poor counting statisticsmay lead to erroneous indication. In MODES 3, 4, 5, and 6, the HighStartup Rate trip is not required to be OPERABLE. Wide rangechannels are required to be OPERABLE in MODES 3, 4, and 5, byLCO 3.3.9, "Neutron Flux Monitoring Channels," and in MODE 6, byLCO 3.9.2, "Nuclear Instrumentation."



BASES

APPLICABILITY(continued) The High Startup Rate Trip Function is required to be OPERABLE in

MODES 1 and 2, but may be bypassed when the associated wide rangeNI channel indicates below 1 E-4% power, when poor counting statisticsmay lead to erroneous indication. In MODES 3, 4, 5, and 6, the HighStartup Rate trip is not required to be OPERABLE. Wide rangechannels are required to be OPERABLE in MODES 3, 4, and 5, byLCO 3.3.9, "Neutron Flux Monitoring Channels," and in MODE 6, byLCO 3.9.2, "Nuclear Instrumentation."

The Loss of Load trip is required to be OPERABLE with THERMALPOWER at or above 17% RTP. Below 17% RTP, the ADVs arecapable of relieving the pressure due to a Loss of Load event withoutchallenging other overpressure protection.

The trips are designed to take the reactor subcritical, maintaining theSLs during AOOs and assisting the ESF in providing acceptableconsequences during accidents.

ACTIONS The most common causes of channel inoperability are outright failure ofloop components or drift of those loop components which is sufficient toexceed the tolerance provided in the plant setpoint analysis. Loopcomponent failures are typically identified by the actuation of alarmsdue to the channel failing to the "safe" condition, during CHANNELCHECKS (when the instrument is compared to the redundantchannels), or during the CHANNEL FUNCTIONAL TEST (when anautomatic component might not respond properly). Typically, the drift ofthe loop components is found to be small and results in a delay ofactuation rather than a total loss of function. Excessive loop componentdrift would, most likely, be identified during a CHANNEL CHECK (whenthe instrument is compared to the redundant channels) or during aCHANNEL CALIBRATION (when instrument loop components arechecked against reference standards).

In the event a channel's trip setpoint is found nonconservative withrespect to the Allowable Value, or the transmitter, instrument loop,signal processing electronics, or RPS bistable trip unit is foundinoperable, all affected Functions provided by that channel must bedeclared inoperable, and the plant must enter the Condition for theparticular protection Functions affected.



BASES

ACTIONS(continued) When the number of inoperable channels in a trip Function exceeds that

specified in any related Condition associated with the same tripFunction, then the plant is outside the safety analysis. Therefore,LCO 3.0.3 is immediately entered if applicable in the current MODE ofoperation.

A Note has been added to the ACTIONS to clarify the application of theCompletion Time rules. The Conditions of this Specification may beentered independently for each Function. The Completion Times ofeach inoperable Function will be tracked separately for each Function,starting from the time the Condition was entered.

A.1

Condition A applies to the failure of a single channel in any requiredRPS Function, except High Startup Rate, Loss of Load, or ZPM BypassRemoval. (Condition A is modified by a Note stating that this Conditiondoes not apply to the High Startup Rate, Loss of Load, or ZPM BypassRemoval Functions. The failure of one channel of those Functions isaddressed by Conditions B, C, or D.)

If one RPS bistable trip unit or associated instrument channel isinoperable, operation is allowed to continue. Since the trip unit andassociated instrument channel combine to perform the trip function, thisCondition is also appropriate if both the trip unit and the associatedinstrument channel are inoperable. Though not required, the inoperablechannel may be bypassed. The provision of four trip channels allowsone channel to be bypassed (removed from service) during operations,placing the RPS in two-out-of-three coincidence logic. The failedchannel must be restored to OPERABLE status or placed in trip within7 days.

Required Action A.1 places the Function in a one-out-of-threeconfiguration. In this configuration, common cause failure of dependentchannels cannot prevent trip.

The Completion Time of 7 days is based on operating experience,which has demonstrated that a random failure of a second channeloccurring during the 7 day period is a low probability event.



BASES

ACTIONS A.1 (continued)(continued)

The Completion Time of 7 days is based on operating experience,which has demonstrated that a random failure of a second channeloccurring during the 7 day period is a low probability event.

B.1

Condition B applies to the failure of a single High Startup Rate trip unitor associated instrument channel.

If one trip unit or associated instrument channel fails, it must be restoredto OPERABLE status prior to entering MODE 2 from MODE 3. Ashutdown provides the appropriate opportunity to repair the trip functionand conduct the necessary testing. The Completion Time is based onthe fact that the safety analyses take no credit for the functioning of thistrip.

C.1

Condition C applies to the failure of a single Loss of Load or associatedinstrument channel.

If one trip unit or associated instrument channel fails, it must be restoredto OPERABLE status prior to THERMAL POWER > 17% RTP followinga shutdown. If the plant is shutdown at the time the channel becomesinoperable, then the failed channel must be restored to OPERABLEstatus prior to THERMAL POWER > 17% RTP. For this CompletionTime, "following a shutdown" means this Required Action does not haveto be completed until prior to THERMAL POWER >_ 17% RTP for thefirst time after the plant has been in MODE 3 following entry into theCondition. The Completion Time trip assures that the plant will not berestarted with an inoperable Loss of Load trip channel.



BASES

ACTIONS D.1 and D.2(continued)

Condition D applies when one or more automatic ZPM Bypass removalchannels are inoperable. If the ZPM Bypass removal channel cannotbe restored to OPERABLE status, the affected ZPM Bypasses must beimmediately removed, or the bypassed RPS trip Function channelsmust be immediately declared to be inoperable. Unless additionalcircuit failures exist, the ZPM Bypass may be removed by placing theassociated "Zero Power Mode Bypass" key operated switch in thenormal position.

A trip channel which is actually bypassed, other than as allowed by theTable 3.3.1-1 footnotes, cannot perform its specified safety function andmust immediately be declared to be inoperable.

E.1 and E.2

Condition E applies to the failure of two channels in any RPS Function,except ZPM Bypass Removal Function. (The failure of ZPM BypassRemoval Functions is addressed by Condition D.).

Condition E is modified by a Note stating that this Condition does notapply to the ZPM Bypass Removal Function.

Required Action E.1 provides for placing one inoperable channel in tripwithin the Completion Time of 1 hour. Though not required, the otherinoperable channel may be (trip channel) bypassed.



BASES

ACTIONS E.1 and E.2 (continued)(continued)

This Completion Time is sufficient to allow the operator to take allappropriate actions for the failed channels while ensuring that the riskinvolved in operating with the failed channels is acceptable. With onechannel of protective instrumentation bypassed or inoperable in anuntripped condition, the RPS is in a two-out-of-three logic for thatfunction; but with another channel failed, the RPS may be operating in atwo-out-of-two logic. This is outside the assumptions made in theanalyses and should be corrected. To correct the problem, one of theinoperable channels is placed in trip. This places the RPS in aone-out-of-two for that function logic. If any of the other unbypassedchannels for that function receives a trip signal, the reactor will trip.

Action E.2 is modified by a Note stating that this Action does not applyto (is not required for) the High Startup Rate and Loss of LoadFunctions.

One channel is required to be restored to OPERABLE status within7 days for reasons similar to those stated under Condition A. After onechannel is restored to OPERABLE status, the provisions of Condition Astill apply to the remaining inoperable channel. Therefore, the channelthat is still inoperable after completion of Required Action E.2 must beplaced in trip if more than 7 days have elapsed since the initial channelfailure.

F.1

The power range excore channels are used to generate the internal ASIsignal used as an input to the TM/LP trip. They also provide input to theThermal Margin Monitors for determination of the Q Power input for theTM/LP trip and the VHPT. If two power range excore channels cannotbe restored to OPERABLE status, power is restricted or reduced duringsubsequent operations because of increased uncertainty associatedwith inoperable power range excore channels which provide input tothose trips.

The Completion Time of 2 hours is adequate to reduce power in anorderly manner without challenging plant systems.



BASES

ACTIONS G.1, G.2.1, and G.2.2(continued)

Condition G is entered when the Required Action and associatedCompletion Time of Condition A, B, C, D, E, or F are not met, or if thecontrol room ambient air temperature exceeds 90 0F.

If the control room ambient air temperature exceeds 90 0F, all ThermalMargin Monitor channels are rendered inoperable because theiroperating temperature limit is exceeded. In this condition, or if theRequired Actions and associated Completion Times are not met, thereactor must be placed in a condition in which the LCO does not apply.To accomplish this, the plant must be placed in MODE 3, with no morethan one full-length control rod capable of being withdrawn or with thePCS boron concentration at REFUELING BORON CONCENTRATIONin 6 hours.

The Completion Time is reasonable, based on operating experience, forplacing the plant in MODE 3 from full power conditions in an orderlymanner and without challenging plant systems. The Completion Time isalso reasonable to ensure that no more than one full-length control rodis capable of being withdrawn or that the PCS boron concentration is atREFUELING BORON CONCENTRATION.

SURVEILLANCE The SRs for any particular RPS Function are found in the SR column ofREQUIREMENTS Table 3.3.1-1 for that Function. Most Functions are subject to

CHANNEL CHECK, CHANNEL FUNCTIONAL TEST, and CHANNELCALIBRATION.

SR 3.3.1.1

Performance of the CHANNEL CHECK once every 12 hours ensuresthat gross failure of instrumentation has not occurred. A CHANNELCHECK is normally a comparison of the parameter indicated on onechannel to a similar parameter on other channels. It is based on theassumption that instrument channels monitoring the same parametershould read approximately the same value. Significant deviationsbetween the two instrument channels could be an indication ofexcessive instrument drift in one of the channels or of something evenmore serious. Under most conditions, a CHANNEL CHECK will detectgross channel failure; thus, it is key to verifying that the instrumentationcontinues to operate properly between each CHANNEL CALIBRATION.



BASES

SURVEILLANCE SR 3.3.1.1 (continued)REQUIREMENTS(continued) Agreement criteria are determined by the plant staff based on a

combination of the channel instrument uncertainties, including indication.and readability. If a channel is outside the criteria, it may be anindication that the transmitter orthe signal processing equipment hasdrifted outside its limits.

The Containment High Pressure and Loss of Load channels arepressure switch actuated. As such, they have no associated controlroom indicator and do not require a CHANNEL CHECK.

The Frequency, about once every shift, is based on operatingexperience that demonstrates the rarity of channel failure. Since theprobability of two random failures in redundant channels in any 12 hourperiod is extremely low, the CHANNEL CHECK minimizes the chanceof loss of protective function due to failure of redundant channels. TheCHANNEL CHECK supplements less formal, but more frequent, checksof channel OPERABILITY during normal operational use of the displaysassociated with the LCO required channels.

SR 3.3.1.2

This SR verifies that the control room ambient air temperature is withinthe environmental qualification temperature limits for the most restrictiveRPS components, which are the Thermal Margin Monitors. Thesemonitors provide input to both the VHPT Function and the TM/LP TripFunction. The 12 hour Frequency is reasonable based on engineeringjudgment and plant operating experience.

SR 3.3.1.3

A daily calibration (heat balance) is performed when THERMALPOWER is > 15%. The daily calibration consists of adjusting the"nuclear power calibrate" potentiometers to agree with the calorimetriccalculation if the absolute difference is > 1.5%. Nuclear power isadjusted via a potentiometer, or THERMAL POWER is adjusted via aThermal Margin Monitor bias number, as necessary, in accordance withthe daily calibration (heat balance) procedure. Performance of the dailycalibration ensures that the two inputs to the Q power measurement areindicating accurately with respect to the much more accurate secondarycalorimetric calculation.



BASES

SURVEILLANCEREQUIREMENTS

(continued)

SR 3.3.1.3 (continued)

The Frequency of 24 hours is based on plant operating experience andtakes into account indications and alarms located in the control room todetect deviations in channel outputs.

The Frequency is modified by a Note indicating this Surveillance mustbe performed within 12 hours after THERMAL POWER is > 15% RTP.The secondary calorimetric is inaccurate at lower power levels. The12 hours allows time requirements for plant stabilization, data taking,and instrument calibration.

SR 3.3.1.4

It is necessary to calibrate the power range excore channel upper andlower subchannel amplifiers such that the measured ASI reflects thetrue core power distribution as determined by the incore detectors. ASIis utilized as an input to the TM/LP trip function where it is used toensure that the measured axial power profiles are bounded by the axialpower profiles used in the development of the Tiniet limitation ofLCO 3.4.1. An adjustment of the excore channel is necessary only ifreactor power is greater than 25% RTP and individual excore channelASI differs from AXIAL OFFSET, as measured by the incores, outsidethe bounds of the following table:

AllowedReactorPower

< 100%< 95< 90< 85< 80< 75< 70< 65< 60< 55< 50< 45< 40< 35< 30< 25

Group 4Rods > 128" withdrawn

-0.020 < (AO-ASI) < 0.020-0.033 < (AO-ASI) < 0.020-0.046 < (AO-ASI) < 0.020-0.060 < (AO-ASI) < 0.020-0.120 < (AO-ASI) < 0.080-0.120 < (AO-ASI) < 0.080-0.120 5 (AO-ASI) < 0.080-0.120 < (AO-ASI) < 0.080-0.160 < (AO-ASI) < 0.120-0.160 5 (AO-ASI) < 0.120-0.160 5 (AO-ASI) 5 0.120-0.160 5 (AO-ASI) 5 0.120-0.160 5 (AO-ASI) 5 0.120-0.160 < (AO-ASI) < 0.120-0.160 5 (AO-ASI) 5 0.120Below 25% RTP any AO/ASI

Group 4Rods <128" withdrawn

-0.040 5 (AO-ASI) 5 0.040-0.053 < (AO-ASI) 5 0.040-0.066 5 (AO-ASI) 5 0.040-0.080 < (AO-ASI) < 0.040-0.140 5 (AO-ASI) 5 0.100-0.140 5 (AO-ASI) 5 0.100-0.140 5 (AO-ASI) < 0.100-0.140 < (AO-ASI) < 0.100-0.180 < (AO-ASI) < 0.140-0.180 5 (AO-ASI) • 0.140-0.180 5 (AO-ASI) < 0.140-0.180 -< (AO-ASI) < 0.140-0.180 < (AO-ASI) < 0.140-0.180 < (AO-ASI) 5 0.140-0.180 5 (AO-ASI) 5 0.140

difference is acceptable

Table values determined with a conservative Pvar gamma constant of -9505.



BASES


(continued)

SR 3.3.1.4 (continued)

Below 25% RTP any difference between ASI and AXIAL OFFSET isacceptable. A Note indicates the Surveillance is not required to havebeen performed until 12 hours after THERMAL POWER is >Ž25% RTP.Uncertainties in the excore and incore measurement process make it

impractical to calibrate when THERMAL POWER is < 25% RTP. The12 hours allows time for plant stabilization, data taking, and instrumentcalibration.

The 31 day Frequency is adequate, based on operating experience ofthe excore linear amplifiers and the slow burnup of the detectors. Theexcore readings are a strong function of the power produced in theperipheral fuel bundles and do not represent an integrated readingacross the core. Slow changes in neutron flux during the fuel cycle canalso be detected at this Frequency.

SR 3.3.1.5

A CHANNEL FUNCTIONAL TEST is performed on each RPSinstrument channel, except Loss of Load and High Startup Rate, every92 days to ensure the entire channel will perform its intended functionwhen needed. For the TM/LP Function, the constants associated withthe Thermal Margin Monitors must be verified to be within tolerances.

A successful test of the required contact(s) of a channel relay may beperformed by the verification of the change of state of a single contactof the relay. This clarifies what is an acceptable CHANNELFUNCTIONAL TEST of a relay. This is acceptable because all of theother required contacts of the relay are verified by other TechnicalSpecifications and non-Technical Specifications tests at least once perrefueling interval with applicable extensions.

Any setpoint adjustment must be consistent with the assumptions of thecurrent setpoint analysis.

The Frequency of 92 days is based on the. reliability analysis presentedin topical report CEN-327, "RPS/ESFAS Extended Test IntervalEvaluation" (Ref. 5).



BASES


(continued)

SR 3.3.1.6

A calibration check of the power range excore channels using theinternal test circuitry is required every 92 days. This SR uses aninternally generated test signal to check that the 0% and 50% levelsread within limits for both the upper and lower detector, both on theanalog meter and on the TMM screen. This check verifies that neitherthe zero point nor the amplifier gain adjustment have undergoneexcessive drift since the previous complete CHANNEL CALIBRATION.

The Frequency of 92 days is acceptable, based on plant operatingexperience, and takes into account indications and alarms available tothe operator in the control room.

SR 3.3.1.7

A CHANNEL FUNCTIONAL TEST on the Loss of Load and HighStartup Rate channels is performed prior to a reactor startup to ensurethe entire channel will perform its intended function.

A successful test of the required contact(s) of a channel relay may beperformed by the verification of the change of state of a single contactof the relay. This clarifies what is an acceptable CHANNELFUNCTIONAL TEST of a relay. This is acceptable because all of theother required contacts of the relay are verified by other TechnicalSpecifications and non-Technical Specifications tests at least once perrefueling interval with applicable extensions.

The High Startup Rate trip is actuated by either of the Wide RangeNuclear Instrument Startup Rate channels. N1-1/3 sends a trip signal toRPS channels A and C; NI-2/4 to channels B and D. Since each HighStartup Rate channel would cause a trip on two RPS channels, the HighStartup Rate trip is not tested when the reactor is critical.

The four Loss of Load Trip channels are all actuated by a singlepressure switch monitoring turbine auto stop oil pressure which is nottested when the reactor is critical. Operating experience has shownthat these components usually pass the Surveillance when performed ata Frequency of once per 7 days prior to each reactor startup.



BASES

SURVEILLANCE SR 3.3.1.8REQUIREMENTS

(continued) SR 3.3.1.8 is the performance of a CHANNEL CALIBRATION every18 months.

CHANNEL CALIBRATION is a complete check of the instrumentchannel including the sensor (except neutron detectors). TheSurveillance verifies that the channel responds to a measuredparameter within the necessary range and accuracy. CHANNELCALIBRATION leaves the channel adjusted to account for instrumentdrift between successive calibrations to ensure that the channel remainsoperational between successive tests. CHANNEL CALIBRATIONSmust be consistent with the setpoint analysis.

The bistable setpoints must be found to trip within the Allowable Valuesspecified in the LCO and left set consistent with the assumptions of thesetpoint analysis. The Variable High Power Trip setpoint shall beverified to reset properly at several indicated power levels during(simulated) power increases and power decreases.

The as-found and as-left values must also be recorded and reviewed forconsistency with the assumptions of the setpoint analysis.

As part of the CHANNEL CALIBRATION of the wide range NuclearInstrumentation, automatic removal of the ZPM Bypass for the Low PCSFlow, TM/LP must be verified to assure that these trips are availablewhen required.

The Frequency is based upon the assumption of an 18 monthcalibration interval for the determination of the magnitude of equipmentdrift.

This SR is modified by a Note which states that it is not necessary tocalibrate neutron detectors because they are passive devices withminimal drift and because of the difficulty of simulating a meaningfulsignal. Slow changes in power range excore neutron detectorsensitivity are compensated for by performing the daily calorimetriccalibration (SR 3.3.1.3) and the monthly calibration using the incoredetectors (SR 3.3.1.4). Sudden changes in detector performance wouldbe noted during the required CHANNEL CHECKS (SR 3.3.1.1).



BASES

REFERENCES 1. 10 CFR 50, Appendix A, GDC 21

2. 10 CFR 100

3. IEEE Standard 279-1971, April 5, 1972

4. FSAR, Chapter 14

5. CEN-327, June 2, 1986, including Supplement 1, March 3, 1989



Table B 3.3.1-1 (page 1 of 1)Instruments Affecting Multiple Specifications

Required Instrument Channels Affected SpecificationsNuclear Instrumentation

Source Range NI-1/3, Count Rate Indication @ C-150 Panel 3.3.8 (#1)Source Range NI-1/3 & 2/4, Count Rate Signal 3.3.9 & 3.9.2Wide Range N1-1/3 & 2/4, Flux Level 10-' Bypass 3.3.1 (#3, 6, 7, 9, & 12)Wide Range NI-1/3 & 2/4, Startup Rate 3.3.1 (#2)Wide Range NI-1/3 & 2/4, Flux Level Indication @EC-06 Panel for 3.3.7 3.3.7 (#3) & 3.3.9Power Range NI-5, 6, 7, & 8, Tq 3.2.1 & 3.2.3Power Range NI-5, 6, 7, & 8, Q Power 3.3.1 (#1 & 9)Power Range NI-5, 6, 7, & 8, ASI 3.3.1 (#9) & 3.2.1 & 3.2.4Power Range NI-5, 6, 7, & 8, Loss of Load/High Startup Rate Bypass 3.3.1 (#2 & 10)

PCS T-Cold InstrumentsTT-0112CA, Temperature Signal (SPI AT Power for PDIL Alarm Circuit) 3.1.6TT-0112CA & 0122CA, Temperature Signal (C-150) 3.3.8 (#6 & 7)TT-0122CB, Temperature Signal (PIP AT Power for PDIL Alarm Circuit) 3.1.6TT-0112CA & 0122CB, Temperature Signal (LTOP) 3.4.12.b. 1TT-0112CC & 0122CD (PTR-0112 & 0122) Temperature Indication 3.3.7 (#2)TT-01 12 & 0122 CC & CD, Temperature Signal (SMM) 3.3.7 (#5)TT-0112 & 0122 CA, CB, CC, & CD, Temperature Signal (Q Power & TMM) 3.3.1 (#1 & 9) & 3.4.1.b

PCS T-Hot InstrumentsTT-0112HA, Temperature Signal (SPI AT Power for PDIL Alarm Circuit) 3.1.6TT-0112HA & 0122HA, Temperature Signal (C-150) 3.3.8 (#4 & 5)TT-0122HB, Temperature Signal (PIP AT Power for PDIL Alarm Circuit) 3.1.6TT-0112 & 0122 HC & HD, Temperature Signal (SMM) 3.3.7 (#5)TT-0112HC & 0122HD (PTR-0112 & 0122) Temperature Indication 3.3.7 (#1)TT-01 12 & 0122 HA, HB, HC, & HD, Temperature Signal (Q Power & TMM) 3.3.1 (#1 & 9)

Thermal Margin MonitorsPY-0102A, B, C, & D 3.3.1 (#1 & 9)

Pressurizer Pressure InstrumentsPT-0102A, B, C, & D, Pressure Signal (RPS & SIS) 3.3.1 (#8 & 9) &

3.3.3 (#1.a & 7a)PT-0104A & B, Pressure Signal (LTOP & SDC Interlock) 3.4.12.b.1 & 3.4.14PT-0105A & B, Pressure Signal (WR Indication & LTOP) 3.3.7 (#5) & 3.4.12.b.1P1-0110, Pressure Indication @ C-150 Panel 3.3.8 (#2)

SG Level InstrumentsLT-0751 & 0752 A, B, C, & D, Level Signal (RPS & AFAS) 3.3.1 (#4 & 5) &

3.3.3 (#4.a & 4.b)LI-0757 & 0758 A & B, Wide Range Level Indication 3.3.7 (#11 & 12)LI-0757C & 0758C, Wide Range Level Indication @ C-150 Panel 3.3.8 (#10 & 11)

SG Pressure InstrumentsPT-0751 & 0752 A, B, C, & D, Pressure Signal (RPS & SG Isolation) 3.3.1 (#6 & 7) &

3.3.3 (#2a, 2b, 7b, 7c)PT-0751A and PT-0752A Pressure Signal (C-150/150A) 3.3.8 (#8 & 9)PIC-0751 & 0752 C & D, Pressure Indication 3.3.7 (#13 & 14)PI-0751E & 0752E, Pressure Indication @ C-150 Panel 3.3.8 (#8 & 9)

Containment Pressure InstrumentsPS-1801, 1802, 1803, & 1804, Switch Output (RPS) 3.3.1 (#11)PS-1801, 1802A, 1803, & 1804A, Switch Output (ESF) 3.3.3 (#5.a)PS-i 801A, 1802, 1803A, & 1804, Switch Output (ESF) 3.3.3 (#5.b)

Note: The information provided in this table is intended for use as an aid to distinguish those instrumentchannels which provide more than one required function and to describe which specifications theyaffect. The information in this table should not be taken as inclusive for all instruments nor affectedspecifications.


DG - UV StartB 3.3.5


B 3.3.5 Diesel Generator (DG) - Undervoltage Start (UV Start)

BASES

BACKGROUND The DGs provide a source of emergency power when offsite power iseither unavailable or insufficiently stable to allow safe plant operation.Undervoltage protection will generate a UV Start in the event a Loss ofVoltage or Degraded Voltage condition occurs. There are two UV StartFunctions for each 2.4 kV vital bus.

Undervoltage protection and load shedding features for safety-relatedbuses at the 2,400 V and lower voltage levels are designed inaccordance with 10 CFR 50, Appendix A, General Design Criterion 17(Ref. 1) and the following features:

1. Two levels of automatic undervoltage protection from loss ordegradation of offsite power sources are provided. The first level(loss of voltage) provides normal loss of voltage protection. Thesecond level of protection (degraded voltage) has voltage andtime delay set points selected for automatic trip of the offsitesources to protect safety-related equipment from sustaineddegraded voltage conditions at all bus voltage levels.Coincidence logic is provided to preclude spurious trips.

2. The undervoltage protection system automatically prevents loadshedding of the safety-related buses when the emergencygenerators are supplying power to the safeguards loads.

3. Control circuits for shedding of Class 1 E and non-Class 1 E loadsduring a Loss of Coolant Accident (LOCA) themselves areClass 1 E or are separated electrically from the Class 1 E portions.



BASES

BACKGROUND Description(continued)

Each 2,400 V Bus (1C and 1D) is equipped with two levels ofundervoltage protection relays (Ref. 2). The first level (Loss of VoltageFunction) relays 127-1 and 127-2 are set at approximately 77% of ratedvoltage with an inverse time relay. One of these relays measuresvoltage on each of the three phases. They protect against sudden lossof voltage as sensed on the corresponding bus using a three-out-of-three coincidence logic. The actuation of the associated auxiliary relayswill trip the associated bus incoming circuit breakers, start its associatedDG, initiate bus load shedding, and activate annunciators in the controlroom. The DG circuit breaker is closed automatically uponestablishment of satisfactory voltage and frequency by the use ofassociated voltage sensing relay 127D-1 or 127D-2.

The second level of undervoltage protection (Degraded VoltageFunction) relays 127-7 and 127-8 are set at approximately 93% of ratedvoltage, with one relay monitoring each of the three phases. Theserelays protect against sustained degraded voltage conditions on thecorresponding bus using a three-out-of-three coincidence logic. Theserelays have a built-in 0.65 second time delay, after which the associatedDG receives a start signal and annunciators in the control room areactuated. If a bus undervoltage exists after an additional six seconds,the associated bus incoming circuit breakers will be tripped and a busload shed will be initiated.

Trip Setpoints

The trip setpoints are based on the analytical limits presented inReferences 3 and 4, and justified in Reference 5. The selection ofthese trip setpoints is such that adequate protection is provided when allsensor and processing time delays are taken into account. To allow forcalibration tolerances, instrumentation uncertainties, and instrumentdrift, setpoints specified in SR 3.3.5.2 are conservatively adjusted withrespect to the analytical limits. A detailed analysis of the degradedvoltage protection is provided in References 3 and 4.

The specified setpoints will ensure that the consequences of accidentswill be acceptable, providing the plant is operated from within the LCOsat the onset of the accident and the equipment functions as designed.



BASES


The DG - UV Start is required for Engineered Safety Features (ESF)systems to function in any accident with a loss of offsite power. Itsdesign basis is that of the ESF Systems.

Accident analyses credit the loading of the DG based on a loss of offsitepower during a LOCA. The diesel loading has been included in thedelay time associated with each safety system component requiring DGsupplied power following a loss of offsite power. This delay timeincludes contributions from the DG start, DG loading, and SafetyInjection System component actuation.

The required channels of UV Start, in conjunction with the ESF systemspowered from the DGs, provide plant protection in the event of any ofthe analyzed accidents discussed in Reference 6, in which a loss ofoffsite power is assumed. UV Start channels are required to meet theredundancy and testability requirements of GDC 21 in 10 CFR 50,Appendix A (Ref. 1).

The delay times assumed in the safety analysis for the ESF equipmentinclude the 10 second DG start delay and the appropriate sequencingdelay, if applicable. The response times for ESFAS actuated equipmentinclude the appropriate DG loading and sequencing delay.

The DG - UV Start channels satisfy Criterion 3 of 10 CFR 50.36(c)(2).

LCO The LCO for the DG - UV Start requires that three channels per bus ofeach UV Start instrumentation Function be OPERABLE when theassociated DG is required to be OPERABLE. The UV Start supportssafety systems associated with ESF actuation.

The Bases for the trip setpoints are as follows:

The voltage trip setpoint is set low enough such that spurious trips ofthe offsite source. due to operation of the undervoltage relays are notexpected for any combination of plant loads and normal grid voltages.



BASES

LCO(continued)

This setpoint at the 2,400 V bus and reflected down to the 480 V buseshas been verified through an analysis to be greater than the minimumallowable motor voltage (90% of nominal voltage). Motors are the mostlimiting equipment in the system. MCC contactor pickup and drop-outvoltage is also adequate at the setpoint values. The analysis ensuresthat the distribution system is capable of starting and operating allsafety-related equipment within the equipment voltage rating at theallowed source voltages. The power distribution system model used inthe analysis has been verified by actual testing (Refs. 5 and 7).

The time delays involved will not cause any thermal damage as thesetpoints are within voltage ranges for sustained operation. They arelong enough to preclude trip of the offsite source caused by the startingof large motors and yet do not exceed the time limits of ESF actuationassumed in FSAR Chapter 14 (Ref. 6) and validated by Reference 8.

Calibration of the undervoltage relays verify that the time delay issufficient to avoid spurious trips.

APPLICABILITY The DG - UV Start actuation Function is required to be OPERABLEwhenever the associated DG is required to be OPERABLE perLCO 3.8.1, "AC Sources - Operating," or LCO 3.8.2, "AC -Sources -Shutdown," so that it can perform its function on a loss of power ordegraded power to the vital bus.

ACTIONS A DG - UV Start channel is inoperable when it does not satisfy theOPERABILITY criteria for the channel's Function.

In the event a channel's trip setpoint is found nonconservative withrespect to the specified setpoint, or the channel is found inoperable,then all affected Functions provided by that channel must be declaredinoperable and the LCO Condition entered. The required channels arespecified on a per DG basis.



BASES

ACTIONS A.1(continued)

Condition A applies if one or more of the three phase UV sensors orrelay logic is inoperable for one or more Functions (Degraded Voltageor Loss of Voltage) per DG bus.

The affected DG must be declared inoperable and the appropriateCondition(s) entered. Because of the three-out-of-three logic in both theLoss of Voltage and Degraded Voltage Functions, the appropriatemeans of addressing channel failure is declaring the DG inoperable,and effecting repair in a manner consistent with other DG failures.

Required Action A.1 ensures that Required Actions for the affected DGinoperabilities are initiated. Depending upon plant MODE, the actionsspecified in LCO 3.8.1 or LCO 3.8.2, as applicable, are requiredimmediately.


A CHANNEL FUNCTIONAL TEST is performed on each UV Start logicchannel every 18 months to ensure that the logic channel will performits intended function when needed. The Undervoltage sensing relaysare tested by SR 3.3.5.2. A successful test of the required contact(s) ofa channel relay may be performed by the verification of the change ofstate of a single contact of the relay. This clarifies what is anacceptable CHANNEL FUNCTIONAL TEST of a relay. This isacceptable because all of the other required contacts of the relay areverified by other Technical Specifications and non-TechnicalSpecifications tests at least once per refueling interval with applicableextensions.

The Frequency of 18 months is based on the plant conditions necessaryto perform the test.



BASES


(continued)

SR 3.3.5.2

A CHANNEL CALIBRATION performed each 18 months verifies theaccuracy of each component within the instrument channel. Thisincludes calibration of the undervoltage relays and demonstrates thatthe equipment falls within the specified operating characteristics definedby the manufacturer.

The Surveillance verifies that the channel responds to a measuredparameter within the necessary range and accuracy.

CHANNEL CALIBRATION leaves the channel adjusted to account forinstrument drift between successive calibrations to ensure that thechannel remains operational between successive tests. CHANNELCALIBRATIONS must be performed consistent with the setpointanalysis.

The Frequency of 18 months is a typical refueling cycle. Operatingexperience has shown this Frequency is acceptable.

REFERENCES 1. 10 CFR 50, Appendix A GDCs 17 and 21

2. FSAR, Section 8.6

3. Analysis EA-ELEC-VOLT-033

4. Analysis EA-ELEC-VOLT-034

5. Analysis EA-ELEC-EDSA-04

6. FSAR, Chapter 14

7. Analysis EA-ELEC-EDSA-03

8. Analysis A-NL-92-1 11


PAM InstrumentationB 3.3.7


B 3.3.7 Post Accident Monitoring (PAM) Instrumentation

BASES

BACKGROUND The primary purpose of the Post Accident Monitoring (PAM)instrumentation is to display plant variables that provide informationrequired by the control room operators during accident situations. Thisinformation provides the necessary support for the operator to take themanual actions, for which no automatic control is provided, that arerequired for safety systems to accomplish their safety Functions forDesign Basis Events.

The OPERABILITY of the PAM instrumentation ensures that there issufficient information available on selected plant parameters to monitorand assess plant status and behavior following an accident.

The availability of PAM instrumentation is important so that responsesto corrective actions can be observed and the need for, and magnitudeof, further actions can be determined. The required instruments areidentified in FSAR Appendix 7C (Ref. 1) and address therecommendations of Regulatory Guide 1.97 (Ref. 2), as required bySupplement 1 to NUREG-0737, "TMI Action Items" (Ref. 3).

Type A variables are included in this LCO because they provide theprimary information required to permit the control room operator to takespecific manually controlled actions, for which no automatic control isprovided, that are required for safety systems to accomplish their safetyfunctions for Design Basis Accidents (DBAs).

Category I variables are the key variables deemed risk significantbecause they are needed to:

Determine whether other systems important to safety areperforming their intended functions;

Provide information to the operators that will enable them todetermine the potential for causing a gross breach of the barriersto radioactivity release; and

Provide information regarding the release of radioactive materialsto allow for early indication of the need to initiate action necessaryto protect the public and for an estimate of the magnitude of anyimpending threat.



BASES

BACKGROUND These key variables are identified in the plant specific Regulatory(continued) Guide 1.97 analyses (Ref. 1). This analysis identified the plant specific

Type A and Category 1 variables and provided justification for deviatingfrom the NRC proposed list of Category I variables.

The specific instrument Functions listed in Table 3.3.7-1 are discussedin the LCO Bases.

APPLICABLE The PAM instrumentation ensures the OPERABILITY of RegulatorySAFETY ANALYSES Guide 1.97 Type A variables, so that the control room operating staff

can:

* Perform the diagnosis specified in the emergency operatingprocedures. These variables are restricted to preplanned actionsfor the primary success path of DBAs; and

" Take the specified, preplanned, manually controlled actions, forwhich no automatic control is provided, that are required for safetysystems to accomplish their safety functions.

The PAM instrumentation also ensures OPERABILITY of Category I,non-Type A variables. This ensures the control room operating staffcan:

Determine whether systems important to safety are performingtheir intended functions;

* Determine the potential for causing a gross breach of the barriersto radioactivity release;

* Determine if a gross breach of a barrier has occurred; and

Initiate action necessary to protect the public as well as to obtainan estimate of the magnitude of any impending threat.

Category I, non-Type A PAM instruments are retained in theSpecification because they are intended to assist operators inminimizing the consequences of accidents. Therefore, these Category Ivariables are important in reducing public risk.

PAM instrumentation that satisfies the definition of Type A in RegulatoryGuide 1.97 meets Criterion 3 of 10 CFR 50.36(c)(2).



BASES

LCO LCO 3.3.7 requires at least two OPERABLE channels for all Functionsexcept Containment Isolation Valve Position Indication. This is toensure no single failure prevents the operators from being presentedwith the information necessary to determine the status of the plant andto bring the plant to, and maintain it in, a safe condition following thataccident.

Furthermore, provision of at least two channels allows a CHANNELCHECK during the post accident phase to confirm the validity ofdisplayed information.

For Containment Isolation Valve Position indication, the importantinformation is the status of the containment penetrations. The LCOrequires one position indication channel for each containment isolationvalve listed in FSAR Appendix 7C (Ref. 1).

Listed below are discussions of the specified instrument Functions listedin Table 3.3.7-1. Component identifiers of the sensors, indicators,power supplies, displays, and recorders in each instrument loop arefound in Reference 1.

1,2. Primary Coolant System (PCS) Hot and Cold LegTemperature (wide range)

PCS wide range Hot and Cold Leg Temperatures are Type B,Category 1 variables provided for verification of core cooling and longterm surveillance.

Reactor outlet temperature inputs to the PAM are provided by two widerange resistance elements and associated transmitters (one in eachloop). The channels provide indication over a range of 50'F to 700'F.

3. Wide Ranae Neutron Flux

Wide Range Neutron Flux indication is a Type B, Category 1 variable,and is provided to verify reactor shutdown.

4. Containment Floor Water Level (wide ranqe)

Wide range Containment Floor Water Level is a Type B, Category 1variable, and is provided for verification and long-term surveillance ofPCS integrity.



BASES

LCO 5. Subcooled Margin Monitor(continued)

The Subcooled Margin Monitor (SMM) is a Type A, Category 1 variableused to identify conditions, which require tripping of the primary coolantpumps and throttling of safety injection flows. Each SMM channel usesa number of PCS pressure and temperature inputs to determine thedegree of PCS subcooling or superheat.

6. Pressurizer Level (Wide Range)

Pressurizer Level is a Type A, Category 1 variable, and is used todetermine whether to terminate Safety Injection (SI), if still in progress,or to reinitiate SI if it has been stopped. Knowledge of pressurizer waterlevel is also used to verify the plant conditions necessary to establishnatural circulation in the PCS and to verify that the plant is maintained ina safe shutdown condition.

7. (Deleted)

8. Condensate Storage Tank (CST) Level

CST Level is a Type D, Category 1 variable, and is provided to ensurewater supply for AFW. The CST provides the safety grade water supplyfor the AFW System. Inventory is monitored by a 0 to 100% levelindication. CST Level is displayed on a control room indicator. Inaddition, a control room annunciator alarms on low level.

The CST is the initial source of water for the AFW System. However,as the CST is depleted, manual operator action is necessary toreplenish the CST.



BASES

LCO 9. Primary Coolant System Pressure (wide ranqe)(continued)

PCS wide range pressure is a Type A, Category 1 variable provided forverification of core cooling and PCS integrity long-term surveillance.

Wide range PCS loop pressure is measured by pressure transmitterswith a span of 0 psia to 3000 psig. Redundant monitoring capability isprovided by two channels of instrumentation. Control room indicationsare provided on C12 and C02.

10. Containment Pressure (wide ranqge)

Wide range Containment Pressure is a Type C, Category 1 variable,and is provided for verification of PCS and containment OPERABILITY.It is also an input to decisions for initiating containment spray.

11, 12. Steam Generator Water Level (wide range)

Wide range Steam Generator Water Level is a Type A, Category 1variable, and is provided to monitor operation of decay heat removal viathe steam generators. The steam generator level instrumentationcovers a span extending from the tube sheet to the steam separators,with an indicated range of -140% to +150%. Redundant monitoringcapability is provided by two channels of instrumentation for each SG.

Operator action for maintenance of heat removal is based on the controlroom indication of Steam Generator Water Level. The indication isused during a SG tube rupture to determine which SG has the rupturedtube. It is also used to determine when to initiate once through coolingon low water level.

13,14. SG Pressure

Steam Generator Pressure is a Type A, Category 1 variable used inaccident identification, including Loss of Coolant, and Steam LineBreak. Redundant monitoring capability is provided by two channels ofinstrumentation for each SG.



BASES

LCO 15. Containment Isolation Valve Position(continued)

Containment Isolation Valve (CIV) Position is a Type B, Category 1variable, and is provided for verification of containment OPERABILITY.

CIV position is provided for verification of containment integrity. In thecase of CIV position, the important information is the isolation status ofthe containment penetration. The LCO requires one channel of valveposition indication in the control room to be OPERABLE for each CIVlisted in FSAR Appendix 7C (Ref. 1). This is sufficient to redundantlyverify the isolation status of each associated penetration via indicatedstatus of the CIVs, and by knowledge of a passive (check) valve or aclosed system boundary.

If a penetration flow path is isolated, position indication for the CIV(s) inthe associated penetration flow path is not needed to determine status.Therefore, as indicated in Note (a) the position indication for valves inan isolated penetration flow path is not required to be OPERABLE.

16, 17, 18, 19. Core Exit Temperature

Core Exit Temperature is a Type C, Category 1 variable, and isprovided for verification and long term surveillance of core cooling.

Each Required Core Exit Thermocouple (CET) channel consists of asingle environmentally qualified thermocouple.

The design of the Incore Instrumentation System includes a Type K(chromel alumel) thermocouple within each of the incore instrumentdetector assemblies.

The junction of each thermocouple is located above the core exit, insidethe incore detector assembly guide tube, that supports and shields theincore instrument detector assembly string from flow forces in the outletplenum region. These core exit thermocouples monitor the temperatureof the reactor coolant as it exits the fuel assemblies.

The core exit thermocouples have a usable temperature range from320F to 23000F, although accuracy is reduced at temperaturesabove 1800 0F.



BASES

LCO 20. Reactor Vessel Water Level(continued)

Reactor Vessel Water Level is monitored by the Reactor Vessel LevelMonitoring System (RVLMS) and is a Type B, Category 1 variableprovided for verification and long-term surveillance of core cooling.

The RVLMS provides a direct measurement of the collapsed liquid levelabove the fuel alignment plate. The collapsed level represents theamount of liquid mass that is in the reactor vessel above the core.Measurement of the collapsed water level is selected because it is adirect indication of the water inventory. The collapsed level is obtainedover the same temperature and pressure range as the saturationmeasurements, thereby encompassing all operating and accidentconditions where it must function. Also, it functions during the recoveryinterval. Therefore, it is designed to survive the high steam temperaturethat may occur during the preceding core recovery interval.

The level range extends from the top of the vessel down to the top ofthe fuel alignment plate. A total of eight Heated Junction Thermocouple(HJTC) pairs are employed in each of the two RVLMS channels. Eachpair consists of a heated junction TC and an unheated junction TC. Thedifferential temperature at each HJTC pair provides discrete indicationof uncovery at the HJTC pair location. This indication is displayed usingLEDs in the control room. This provides the operator with adequateindication to track the progression of the accident and to detect theconsequences of its mitigating actions or the functionality of automaticequipment.

A RVLMS channel consists of eight sensors in a probe. A channel isOPERABLE if four or more sensors, two or more of the upper four andtwo or more of the lower four, are OPERABLE.

21. Containment Area Radiation (high range)

High range Containment Area Radiation is a Type E, Category 1variable, and is provided to monitor for the potential of significantradiation releases and to provide release assessment for use byoperators in determining the need to invoke site emergency plans.



BASES

APPLICABILITY The PAM instrumentation LCO is applicable in MODES 1, 2, and 3.These variables are related to the diagnosis and preplanned actionsrequired to mitigate DBAs. The applicable DBAs are assumed to occurin MODES 1, 2, and 3. In MODES 4, 5, and 6, plant conditions aresuch that the likelihood of an event occurring that would require PAMinstrumentation is low; therefore, PAM instrumentation is not required tobe OPERABLE in these MODES.

ACTIONS A note has been added in the ACTIONS to clarify the application ofCompletion Time rules. The Conditions of this Specification may beentered independently for each Function listed in Table 3.3.7-1. TheCompletion Time(s) of the inoperable channel(s) of a Function will betracked separately for each Function, starting from the time theCondition was entered for that Function.

A.1

When one or more Functions have one required channel that isinoperable, the required inoperable channel must be restored toOPERABLE status within 30 days. The 30-day Completion Time isbased on operating experience and takes into account the remainingOPERABLE channel, the passive nature of the instrument (no criticalautomatic action is assumed to occur from these instruments), and thelow probability of an event requiring PAM instrumentation during thisinterval.

ACTIONS B._1(continued)

This Required Action specifies initiation of actions in accordance withSpecification 5.6.6, which requires a written report to be submitted tothe Nuclear Regulatory Commission. This, report discusses the resultsof the root cause evaluation of the inoperability and identifies proposedrestorative Required Actions. This Required Action is appropriate in lieuof a shutdown requirement, given the likelihood of plant conditions thatwould require information provided by this instrumentation. Also,alternative Required Actions are identified before a loss of functionalcapability condition occurs.

C.1

When one or more Functions have two required channels inoperable(i.e., two channels inoperable in the same Function), one channel in theFunction should be restored to OPERABLE status within 7 days. TheCompletion Time of 7 days is based on the relatively low probability ofan event requiring PAM instrumentation operation and the availability of



BASES

alternate means to obtain the required information. Continuousoperation with two required channels inoperable in a Function is notacceptable because the alternate indications may not fully meet allperformance qualification requirements applied to the PAMinstrumentation. Therefore, requiring restoration of one inoperablechannel of the Function limits the risk that the PAM Function will be in adegraded condition should an accident occur.

D.1

Condition D is currently not used.



BASES

ACTIONS E.1(continued)

This Required Action directs entry into the appropriate Conditionreferenced in Table 3.3.7-1. The applicable Condition referenced in theTable is Function dependent. Each time Required Action C.1 is notmet, and the associated Completion Time has expired, Condition E isentered for that channel and provides for transfer to the appropriatesubsequent Condition.

F.1 and F.2

If the Required Action and associated Completion Time of Condition Cis not met, and Table 3.3.7-1 directs entry into Condition F, the plantmust be brought to a MODE in which the requirements of this LCO donot apply. To achieve this status, the plant must be brought to at leastMODE 3 within 6 hours and to MODE 4 within 30 hours.

The allowed Completion Times are reasonable, based on operatingexperience, to reach the required plant conditions from full powerconditions in an orderly manner and without challenging plant systems.

G.1

Alternate means of monitoring Reactor Vessel Water Level andContainment Area Radiation have been developed and tested. Thesealternate means may be temporarily installed if the normal PAM channelcannot be restored to OPERABLE status within the allotted time. Ifthese alternate means are used, the Required Action is not to shutdown the plant, but rather to follow the directions of Specification 5.6.6.The report provided to the NRC should discuss the alternate meansused, describe the degree to which the alternate means are equivalentto the installed PAM channels, justify the areas in which they are notequivalent, and provide a schedule for restoring the normal PAMchannels.



BASES

SURVEILLANCE A Note at the beginning of the Surveillance Requirements specifies thatREQUIREMENTS the following SRs apply to each PAM instrumentation Function in

Table 3.3.7-1.

SR 3.3.7.1

Performance of the CHANNEL CHECK once every 31 days ensuresthat a gross failure of instrumentation has not occurred. A CHANNELCHECK is normally a comparison of the parameter indicated on onechannel to a similar parameter on other channels. It is based on theassumption that instrument channels monitoring the same parametershould read approximately the same value. Significant deviationsbetween the two instrument channels could be an indication ofexcessive instrument drift in one of the channels or of something evenmore serious. A CHANNEL CHECK will detect gross channel failure;thus, it is key to verify the instrumentation continues to operate properlybetween each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff based on acombination of the channel instrument uncertainties, including indicationand readability. If a channel is outside the criteria, it may be anindication that the sensor or the signal processing equipment has driftedoutside its limit. If the channels are within the criteria, it is an indicationthat the channels are OPERABLE. If the channels are normally offscale during times when surveillance is required, the CHANNELCHECK will only verify that they are off scale in the same direction. Offscale low current loop channels are verified to be reading at the bottomof the range and not failed downscale.

As indicated in the SR, a CHANNEL CHECK is only required for thosechannels which are normally energized.

The Frequency of 31 days is based upon plant operating experiencewith regard to channel OPERABILITY and drift, which demonstratesthat failure of more than one channel of a given Function in any 31-dayinterval is a rare event. The CHANNEL CHECK supplements lessformal, but more frequent, checks of channel during normal operationaluse of the displays associated with this LCO's required channels.




BASES

SURVEILLANCEREQUIREMENTS(continued)

SR 3.3.7.2

A CHANNEL CALIBRATION is performed every 18 months orapproximately every refueling. CHANNEL CALIBRATION is typically acomplete check of the instrument channel including the sensor.Therefore, this SR is modified by a Note, which states that it is notnecessary to calibrate neutron detectors because of the difficulty ofsimulating a meaningful signal. Wide range and source range nuclearinstrument channels are not calibrated to indicate the actual power levelor the flux in the detector location. The circuitry is adjusted so that widerange and source range readings may be used to determine theapproximate reactor flux level for comparative purposes. TheSurveillance verifies the channel responds to the measured parameterwithin the necessary range and accuracy.

For the core exit thermocouples, a CHANNEL CALIBRATION isperformed by substituting a known voltage for the thermocouple.

The Frequency is based upon operating experience and consistencywith the typical industry refueling cycle and is justified by an 18 monthcalibration interval for the determination of the magnitude of equipmentdrift.

REFERENCES 1. FSAR, Appendix 7C, "Regulatory Guide 1.97

Instrumentation"

2. Regulatory Guide 1.97

3. NUREG-0737, Supplement 1


PCS P/T LimitsB 3.4.3

B 3.4 PRIMARY COOLANT SYSTEM (PCS)

B 3.4.3 PCS Pressure and Temperature (P/T) Limits

BASES

BACKGROUND All components of the PCS are designed to withstand effects of cyclicloads due to system pressure and temperature changes. These loadsare introduced by startup (heatup) and shutdown (cooldown) operations,power transients, and reactor trips. This LCO limits the pressure andtemperature changes during PCS heatup and cooldown, within the designassumptions and the stress limits for cyclic operation.

Figures 3.4.3-1 and 3.4.3-2 contain P/T limit curves for heatup, cooldown,and Inservice Leak and Hydrostatic (ISLH) testing, and data for themaximum rate of change of primary coolant temperature.

Each P/T limit curve defines an acceptable region for normal operation.The P/T limit curves include an allowance to account for the fact thatpressure is measured in the pressurizer rather than at the vessel beltlineand to account for primary coolant pump discharge pressure. The use ofthe curves provides operational limits during heatup or cooldownmaneuvering, when pressure and temperature indications are monitoredand compared to the applicable curve to determine that operation iswithin the allowable region.

The LCO establishes operating limits that provide a margin to brittlefailure of the reactor vessel and piping of the Primary Coolant PressureBoundary (PCPB). The vessel is the component most subject to brittlefailure, and the LCO limits apply to the vessel.

10 CFR 50, Appendix G (Ref. 2), requires the establishment of P/T limitsfor material fracture toughness requirements of the PCPB materials.Reference 2 requires an adequate margin to brittle failure during normaloperation, anticipated operational occurrences, and system hydrostatictests.

The neutron embrittlement effect on the material toughness is reflected byincreasing the nil ductility reference temperature (RTNDT) as neutronfluence increases.

The actual shift in the RTNDT of the vessel material will be establishedperiodically by removing and evaluating the irradiated reactor vesselmaterial specimens, in accordance with ASTM E 185 (Ref. 4) andAppendix H of 10 CFR 50 (Ref. 5). The operating P/T limit curves will beadjusted, as necessary, based on the evaluation findings and therequirements of 10 CFR 50, Appendix G (Ref. 2).



BASES


A discussion of the methodology for the development of the P/T limitcurves is provided in Reference 1 and Reference 7. The P/T limit curveswere originally developed to be valid up to an accumulated reactor vesselwall fluence at the limiting circumferential weld of 2.192 x 1019 n/cm 2 (E>1.0 MeV). It was subsequently determined that this fluence would bereached prior to the operating license expiration date. In order tocontinue to use the existing P/T limit curves, an evaluation (Ref. 8) usingmore recently approved NRC methods was performed to demonstratethat the P/T limit curves are valid through the operating license expirationdate, equivalent to 42.1 Effective Full Power Years (EFPY). Thisevaluation was performed using the adjusted RTNDT (ART) correspondingto the limiting beltline region material of the reactor vessel. The ART isdefined as the sum of the initial reference temperature (RTNDT) of thematerial, the mean value for the adjustment in RTNDT caused by neutronirradiation, and a margin term to account for uncertainties in RTNDT,

percent nickel, percent copper, neutron fluence and calculationalprocedures (Ref. 9).

The specific input parameters below were used to validate that theexisting P/T limit curves are conservative through an applicability periodof 42.1 EFPY. The input parameters are for the limiting reactor vesselmaterial, which are the intermediate and lower shell axial welds 2-112and 3-112.

1. A peak reactor vessel wall surface fluence of 2.161 x 1019 n/cm 2

(E > 1.0 MeV)2. ART values, at 1/4T = 252.7°F, and at 3/4T = 185.8°F3. Initial RTNDT = -56 *F4. Margin term = 65.5 'F

The P/T limit curves are composite curves established by superimposinglimits derived from stress analyses of those portions of the reactor vesseland head that are the most restrictive. At any specific pressure,temperature, and temperature rate of change, one location within thereactor vessel will dictate the most restrictive limit. Across the span of theP/T limit curves, different locations are more restrictive, and, thus, thecurves are composites of the most restrictive regions.


PCS PIT LimitsB 3.4.3

BASES

BACKGROUND The heatup curve represents a different set of restrictions than the(continued) cooldown curve because the directions of the thermal gradients through

the vessel wall are reversed. The thermal gradient reversal may alter thelocation of the tensile stress between the outer and inner walls.

The minimum temperature at which the reactor can be made critical, asrequired by Reference 2, shall be at least 40°F above the heatup curve orthe cooldown curve and not less than the minimum permissibletemperature for the ISLH testing. However, the criticality limit is notoperationally limiting; a more restrictive limit exists in LCO 3.4.2, "PCSMinimum Temperature for Criticality," and LCO 3.1.7, "Special TestExceptions (STE)."

The consequence of violating the LCO limits is that the PCS has beenoperated under conditions that can result in brittle failure of the PCPB,possibly leading to a nonisolable leak or loss of coolant accident. In theevent these limits are exceeded, an evaluation must be performed todetermine the effect on the structural integrity of the PCPB components.The ASME Code, Section XI, Appendix E (Ref. 6), provides arecommended methodology for evaluating an operating event that causesan excursion outside the limits.

APPLICABLE The P/T limits are not derived from Design Basis Accident (DBA)SAFETY ANALYSES Analyses. They are prescribed during normal operation to avoid

encountering pressure, temperature, and temperature rate of changeconditions that might cause undetected flaws to propagate and causenonductile failure of the PCPB, an unanalyzed condition. Reference 1establishes the methodology for determining the P/T limits. Since the P/Tlimits are not derived from any DBA, there are no acceptance limitsrelated to the P/T limits. Rather, the P/T limits are acceptance limitsthemselves since they preclude operation in an unanalyzed condition.

The PCS P/T limits satisfy Criterion 2 of 10 CFR 50.36(c)(2).



BASES

LCO The two elements of this LCO are:

a. The limit curves for heatup, cooldown, and ISLH testing; and

b. Limits on the rate of change of temperature.

The LCO limits apply to all components of the PCS, except thepressurizer.

These limits define allowable operating regions and permit a largenumber of operating cycles while providing a wide margin to nonductilefailure.

The limits for the rate of change of temperature control the thermalgradient through the vessel wall and are used as inputs for calculating theheatup, cooldown, and ISLH testing P/T limit curves. Additional cooldownrate restrictions were put in place due to the reactor vessel head nozzlerepairs per Reference 7. Thus, the LCO for the rate of change oftemperature restricts stresses caused by thermal gradients and alsoensures the validity of the P/T limit curves.

Violating the LCO limits places the reactor vessel outside of the bounds ofthe stress analyses and can increase stresses in other PCPBcomponents. The consequences depend on several factors, as follows:

a. The severity of the departure from the allowable operating P/Tregime or the severity of the rate of change of temperature;

b. The length of time the limits were violated (longer violations allowthe temperature gradient in the thick vessel walls to become morepronounced); and

c. The existences, sizes, and orientations of flaws inthe vessel material.

APPLICABILITY The PCS P/T limits Specification provides a definition of acceptableoperation for prevention of nonductile failure in accordance with10 CFR 50, Appendix G (Ref. 2) and due to the reactor vessel nozzlerepairs (Ref. 7). Although the P/T limits were developed to provideguidance for operation during heatup or cooldown (MODES 3, 4, and 5)or ISLH testing, their Applicability is at all times in keeping with theconcern for nonductile failure. The additional cooldown rate restrictionsfor the reactor vessel nozzle repairs only apply when the reactor vesselhead is on the reactor vessel. The limits do not apply to the pressurizer.



BASES

APPLICABILITY(continued)

During MODES 1 and 2, other Technical Specifications provide limitsfor operation that can be more restrictive than or can supplement theseP/T limits. LCO 3.4.1, "PCS Pressure, Temperature, and Flow Departurefrom Nucleate Boiling (DNB) Limits"; LCO 3.4.2, "PCS MinimumTemperature for Criticality"; and Safety Limit 2.1, "Safety Limits," alsoprovide operational restrictions for pressure and temperature andmaximum pressure. Furthermore, MODES 1 and 2 are above thetemperature range of concern for nonductile failure, and stress analyseshave been performed for normal maneuvering profiles, such as powerascension or descent.

The actions of this LCO consider the premise that a violation of the limitsoccurred during normal plant maneuvering. Severe violations caused byabnormal transients, at times accompanied by equipment failures, mayalso require additional actions from emergency operating procedures.

ACTIONS A.1 and A.2

Operation outside the P/T limits must be corrected so that the PCPB isreturned to a condition that has been verified by stress analyses.

The 30 minute Completion Time reflects the urgency of restoring theparameters to within the analyzed range. Most violations will not besevere, and the activity can be accomplished in this time in a controlledmanner.

Besides restoring operation to within limits, an evaluation is required todetermine if PCS operation can continue. The evaluation must verify thePCPB integrity remains acceptable and must be completed beforecontinuing operation. Several methods may, be used, includingcomparison with pre-analyzed transients in the stress analyses, newanalyses, or inspection of the components.

ASME Code, Section XI, Appendix E (Ref. 6), may be used to support theevaluation. However, its use is restricted to evaluation of the vesselbeltline.

The 72 hour Completion Time is reasonable to accomplish the evaluation.The evaluation for a mild violation is possible within this time, but moresevere violations may require special, event specific stress analyses orinspections. A favorable evaluation must be! completed before continuingto operate.



BASES

ACTIONS A.1 and A.2 (continued)

Condition A is modified by a Note requiring Required Action A.2 to becompleted whenever the Condition is entered. The Note emphasizes theneed to perform the evaluation of the effects of the excursion outside theallowable limits. Restoration alone per Required Action A.1 is insufficientbecause higher than analyzed stresses may have occurred and may haveaffected the PCPB integrity.

B.1 and B.2

If a Required Action and associated Completion Time of Condition A arenot met, the plant must be placed in a lower MODE because:

a. The PCS remained in an unacceptable P/T region for an extendedperiod of increased stress; or

b. A sufficiently severe event caused entry into an unacceptableregion.

Either possibility indicates a need for more careful examination of theevent, best accomplished with the PCS at reduced pressure andtemperature. With reduced pressure and temperature conditions, thepossibility of propagation of undetected flaws is generally decreased.

Pressure and temperature are reduced by placing the plant in MODE 3within 6 hours and in MODE 5 with PCS pressure < 270 psia within36 hours.

The Completion Times are reasonable, based on operating experience, toreach the required plant conditions from full power conditions in anorderly manner and without challenging plant systems.



BASES

ACTIONS C.1 and C.2(continued)

The actions of this LCO, anytime other than in MODE 1, 2, 3, or 4,consider the premise that a violation of the limits occurred during normalplant maneuvering. Severe violations caused by abnormal transients, attimes accompanied by equipment failures, may also require additionalactions from emergency operating procedures. Operation outside the P/Tlimits must be corrected so that the PCPB is returned to a condition thathas been verified by stress analyses.

The Completion Time of "immediately" reflects the urgency of restoringthe parameters to within the analyzed range. Most violations will not besevere, and the activity can be accomplished in a short period of time in acontrolled manner.

Besides restoring operation to within limits, an evaluation is required todetermine if PCS operation can continue. The evaluation must verify thatthe PCPB integrity remains acceptable and must be completed beforecontinuing operation. Several methods may be used, includingcomparison with pre-analyzed transients in the stress analyses, newanalyses, or inspection of the components.

ASME Code, Section XI, Appendix E (Ref. 6), may be used to support theevaluation. However, its use is restricted to evaluation of the vesselbeltline.

The Completion Time of prior to entering MODE 4 forces the evaluationprior to entering a MODE where temperature and pressure can besignificantly increased. The evaluation for a mild violation is possiblewithin several days, but more severe violations may require special, eventspecific stress analyses or inspections.

Condition C is modified by a Note requiring Required Action C.2 to becompleted whenever the Condition is entered. The Note emphasizes theneed to perform the evaluation of the effects of the excursion outside theallowable limits. Restoration alone per Required Action C.1 is insufficientbecause higher than analyzed stresses may, have occurred and may haveaffected the PCPB integrity.



BASES


Verification that operation is within the limits of Figure 3.4.3-1 andFigure 3.4.3-2 is required every 30 minutes when PCS pressure andtemperature conditions are undergoing planned changes. ThisFrequency is considered reasonable in view of the control room indicationavailable to monitor PCS status. Also, since temperature rate of changelimits are specified in hourly increments, 30 minutes permits assessmentand correction for minor deviations within a reasonable time. Calculationof the average hourly cooldown rate must consider changes in reactorvessel inlet temperature caused by initiating shutdown cooling, by startingprimary coolant pumps with a temperature difference between the steamgenerator and PCS, or by stopping primary coolant pumps with shutdowncooling in service. The additional restrictions in Figure 3.4.3-2, requiredfor the reactor vessel head nozzle repairs, use the average core exittemperature to provide the best indication available of the temperature ofthe head inside material temperature. This indication may be either theaverage of the core exit thermocouples or the vessel outlet temperature.

Surveillance for heatup and cooldown operations may be discontinuedwhen the definition given in the relevant plant procedure for ending theactivity is satisfied.

This SR is modified by a Note that requires this SR be performed onlyduring PCS heatup and cooldown operations. No SR is given forcriticality operations because LCO 3.4.2 contains a more restrictiverequirement.



BASES

REFERENCES 1. Safety Evaluation for Palisades Nuclear Plant LicenseAmendment No. 245, dated January 19, 2012

2. 10 CFR 50, Appendix G

3. Deleted

4. ASTM E 185-82, July 1982

5. 10 CFR 50, Appendix H

6. ASME, Boiler and Pressure Vessel Code, Section XI, Appendix E

7. Safety Evaluation for Palisades Nuclear Plant LicenseAmendment No. 218, dated November 8, 2004

8. Engineering Analysis EA-EC27959-01, "Palisades Pressure-Temperature Limit Curves and Upper-Shelf Energy Evaluation,"February 2012

9. Regulatory Guide 1.99, Revision 2, May 1988


LTOP SystemB 3.4.12

B 3.4 PRIMARY COOLANT SYSTEM (PCS)

B 3.4.12 Low Temperature Overpressure Protection (LTOP) System

BASES

BACKGROUND The LTOP System controls PCS pressure at low temperatures so theintegrity of the Primary Coolant Pressure Boundary (PCPB) is notcompromised by violating the Pressure and Temperature (P/T) limits of10 CFR 50, Appendix G (Ref. 1). The reactor vessel is the limiting PCPBcomponent requiring such protection. LCO 3.4.3, "PCS Pressure andTemperature (P/T) Limits," provides the allowable combinations foroperational pressure and temperature during cooldown, shutdown, andheatup to keep from violating the Reference 1 requirements during theLTOP MODES.

The toughness of the reactor vessel material decreases at lowtemperatures. As the vessel neutron exposure accumulates, the materialtoughness decreases and becomes less resistant to pressure stress atlow temperatures (Ref. 2). PCS pressure, therefore, is maintained low atlow temperatures and is increased only as temperature is increased.

The potential for vessel overpressurization is most acute when the PCS iswater solid, which occurs only while shutdown. Under that condition, apressure fluctuation can occur more quickly than an operator can react torelieve the condition. Exceeding the PCS P/T limits by a significantamount could cause brittle fracture of the reactor vessel. LCO 3.4.3requires administrative control of PCS pressure and temperature duringheatup and cooldown to prevent exceeding the P/T limits.

This LCO provides PCS overpressure protection by limiting coolantinjection capability and requiring adequate pressure relief capacity.Limiting coolant injection capability requires all High Pressure SafetyInjection (HPSI) pumps be incapable of injection into the PCS when anyPCS cold leg temperature is < 3000 F. The pressure relief capacityrequires either two OPERABLE redundant Power Operated Relief Valves(PORVs) or the PCS depressurized and a PCS vent of sufficient size.One PORV or the PCS vent is the overpressure protection device thatacts to terminate an increasing pressure event.

Palisades Nuclear Plant B 3.4.12-1 Revised 02/17/2012Palisades Nuclear Plant B 3.4.12-1 Revised 02/17/2012

LTOP SystemB 3.4.12

BASES


With limited coolant injection capability, the ability to provide corecoolant addition is restricted. The LCO does not require the chemical andvolume control system to be deactivated or the Safety Injection Signals(SIS) blocked. Due to the lower pressures in the LTOP MODES and theexpected core decay heat levels, the chemical and volume control systemcan provide adequate flow via the makeup control valve. If conditionsrequire the use of an HPSI pump for makeup in the event of loss ofinventory, then a pump can be made available through manual actions.

The LTOP System for pressure relief consists of two PORVs withtemperature dependent lift settings or a PCS vent of sufficient size.Two PORVs are required for redundancy. One PORV has adequaterelieving capability to prevent overpressurization for the allowed coolantinjection capability.

PORV Requirements

As designed for the LTOP System, an "open" signal is generated for eachPORV if the PCS pressure approaches a limit determined by the LTOPactuation logic. The actuation logic monitors PCS pressure and cold legtemperature to determine when the LTOP overpressure setting isapproached. If the indicated pressure meets or exceeds the calculatedvalue, a PORV is opened.

The LCO presents the PORV setpoints for LTOP by specifyingFigure 3.4.12-1, "LTOP Setpoint Limit." Having the setpoints of bothvalves within the limits of the LCO ensures the P/T limits will not beexceeded in any analyzed event.

When a PORV is opened in an increasing pressure transient, the releaseof coolant causes the pressure increase to slow and reverse. As thePORV releases coolant, the system pressure decreases until a resetpressure is reached and the valve closed. The pressure continues todecrease below the reset pressure as the valve closes.


LTOP SystemB 3.4.12

BASES

BACKGROUND PCS Vent Requirements(continued)

Once the PCS is depressurized, a vent exposed to the containmentatmosphere will maintain the PCS at containment ambient pressure in anPCS overpressure transient if the relieving requirements of the transientdo not exceed the capabilities of the vent. Thus, the vent path must becapable of relieving the flow resulting from the limiting LTOP massinjection or heatup transient and maintaining pressure below the P/Tlimits. The required vent capacity may be provided by one or more ventpaths.

Reference 3 has determined that any vent path capable of relieving167 gpm at a PCS pressure of 315 psia is acceptable. The 167 gpm flowrate is based on an assumed charging imbalance due to interruption ofletdown flow with three charging pumps operating, a 40'F per hour PCSheatup rate, a 60°F per hour pressurizer heatup rate, and an initiallydepressurized and vented PCS. Neither HPSI pump nor Primary CoolantPump (PCP) starts need to be assumed with the PCS initiallydepressurized, because LCO 3.4.12 requires both HPSI pumps to beincapable of injection into the PCS and LCO 3.4.7, "PCS Loops-MODE 5,Loops Filled," places restrictions on starting a PCP.

The pressure relieving ability of a vent path depends not only upon thearea of the vent opening, but also upon the configuration of the pipingconnecting the vent opening to the PCS. A long, or restrictive pipingconnection may prevent a larger vent opening from providing adequateflow, while a smaller opening immediately adjacent to the PCS could beadequate. The areas of multiple vent paths cannot simply be added todetermine the necessary vent area.

The following vent path examples are acceptable:

1. Removal of a steam generator primary manway;

2. Removal of the pressurizer manway;

3. Removal of a PORV or pressurizer safety valve;

4. Both PORVs and associated block valves open; and

5. Opening of both PCS vent valves MV-PC514 and MV-PC515.


LTOP SystemB 3.4.12

BASES


Reference 4 determined that venting the PCS through MV-PC514 andMV-PC515 provided adequate flow area. The other listed examplesprovide greater flow areas with less piping restriction and are thereforeacceptable. Other vent paths shown to provide adequate capacity couldalso be used. The vent path(s) must be above the level of reactorcoolant, to prevent draining the PCS.

One open PORV provides sufficient flow area to prevent excessive PCSpressure. However, if the PORVs are elected as the vent path, bothvalves must be used to meet the single failure criterion, since the PORVsare held open against spring pressure by energizing the operatingsolenoid.

When the shutdown cooling system is in service with MO-3015 andMO-3016 open, additional overpressure protection is provided by therelief valves on the shutdown cooling system. References 5 and 6 showthat this relief capacity will prevent the PCS pressure from exceeding itspressure limits during any of the above mentioned events.

APPLICABLESafety Analyses

Safety analyses (Ref. 7) demonstrate that the reactor vessel isadequately protected against exceeding the Reference 1 PIT limits duringshutdown. In MODES 1 and 2, and in MODE 3 with all PCS cold legtemperature at or exceeding 430 0F, the pressurizer safety valves preventPCS pressure from exceeding the Reference 1 limits. Below 430'F,overpressure prevention falls to the OPERABLE PORVs or to adepressurized PCS and a sufficiently sized PCS vent. Each of thesemeans has a limited overpressure relief capability.

The actual temperature at which the pressure in the P/T limit curve fallsbelow the pressurizer safety valve setpoint increases as the reactorvessel material toughness decreases due to neutron embrittlement. Eachtime the P/T limit curves are revised, the LTOP System should bere-evaluated to ensure its functional requirements can still be satisfiedusing the PORV method or the depressurized and vented PCS condition.

Reference 3 contains the acceptance limits that satisfy the LTOPrequirements. When originally generated, the validity period for the LTOPSetpoint Limit curve in Figure 3.4.12-1, which is based on the Reference3 analysis, ended prior to the operating license expiration date. Asubsequent analysis was performed (Ref. 9) which demonstrated that thecurrent LTOP Setpoint Limit curve is valid through the operating licenseexpiration date, equivalent to 42.1 effective full power years of operation.Any change to the PCS must be evaluated against these analyses todetermine the impact of the change on the LTOP acceptance limits.


LTOP SystemB 3.4.12

BASES

APPLICABLE Transients that are capable of overpressurizing the PCS areSafety Analyses categorized as either mass injection or heatup transients(continued)

Mass Iniection Type Transients

a. Inadvertent safety injection; or

b. Charging/letdown flow mismatch.

Heatup Tvoe Transients

a. Inadvertent actuation of pressurizer heaters;

b. Loss of Shutdown Cooling (SDC); or

c. PCP startup with temperature asymmetry within the PCS orbetween the PCS and steam generators.

Rendering both HPSI pumps incapable of injection is required during theLTOP MODES to ensure that mass injection transients beyond thecapability of the LTOP overpressure protection system, do not occur. TheReference 3 analyses demonstrate that either one PORV or the PCS ventcan maintain PCS pressure below limits when three charging pump areactuated. Thus, the LCO prohibits the operation of both HPSI pumps anddoes not place any restrictions on charging pump operation.

Fracture mechanics analyses were used to establish the applicabletemperature range for the LTOP LCO as below 4301F. At and above thistemperature, the pressurizer safety valves provide the reactor vesselpressure protection. The pressure-temperature limit curves and LTOPcurve are based on reactor vessel material properties which change overtime due to radiation embrittlement. These curves are valid for the periodof time corresponding to the reactor vessel material condition which wasassumed when the curves were generated. At the time the curves weredeveloped, they were based on being valid up to a neutron irradiationaccumulation equal to 2.192 x 1019 n (neutrons)/cm 2 (Ref. 3). The vesselmaterials in the current curve analysis (Ref. 9) were assumed to have aneutron irradiation accumulation equal to 42.1 effective full power years ofoperation. The current analysis determined an LTOP enable temperaturethat is bounded by the LTOP LCO.


LTOP SystemB 3.4.12

BASES

APPLICABLESafety Analyses

(continued)

PORV Performance

The fracture mechanics analyses show that the vessel is protected whenthe PORVs are set to open at or below the setpoint curve specified inFigure 3.4.12-1 of the accompanying LCO. The setpoint is derived bymodeling the performance of the LTOP System, assuming the limitingallowed LTOP transient. The valve qualification process consideredpressure overshoot and undershoot beyond the PORV opening andclosing setpoints, resulting from signal processing and valve stroke times.The PORV setpoints at or below the derived limit ensure the Reference 1limits will be met.

The PORV setpoints will be re-evaluated for compliance when the P/Tlimits are revised. The P/T limits are periodically modified as the reactorvessel materialtoughness decreases due to embrittlement caused byneutron irradiation. Revised P/T limits are determined using neutronfluence projections and the results of examinations of the reactor vesselmaterial irradiation surveillance specimens. The Bases for LCO 3.4.3discuss these examinations.

The PORVs are considered active components. Thus, the failure of onePORV represents the worst case, single active failure.

PCS Vent Performance

With the PCS depressurized, analyses show the required vent size iscapable of mitigating the limiting allowed LTOP overpressure transient. Inthat event, this size vent maintains PCS pressure less than the maximumPCS pressure on the P/T limit curve.

The PCS vent is passive and is not subject to active failure.

LTOP System satisfies Criterion 2 of 10 CFR 50.36(c)(2).


LTOP SystemB 3.4.12

BASES

LCO This LCO is required to ensure that the LTOP System is OPERABLE.The LTOP System is OPERABLE when both HPSI pumps are incapableof injecting into the PCS and pressure relief capabilities are OPERABLE.Violation of this LCO could lead to the loss of low temperatureoverpressure mitigation and violation of the Reference 1 limits as a resultof an operational transient.

To limit the coolant injection capability, LCO 3.4.12.a requires both HPSIpumps be incapable of injecting into the PCS. LCO 3.4.12.a is modifiedby two Notes. Note 1 only requires both HPSI pumps to be incapable ofinjecting into the PCS when any PCS cold leg temperature is < 300'F.When all PCS cold leg temperatures are __ 300°F, a start of both HPSIpumps in conjunction with a charging/letdown imbalance will not causethe PCS pressure to exceed the 10 CFR 50 Appendix G limits. Thus, arestriction on HPSI pump operation when all PCS cold leg temperaturesare > 300OF is not required. Note 2 is provided to assure that this LCOdoes not cause hesitation in the use of a HPSI pump for PCS makeup if itis needed due to a loss of shutdown cooling or a loss of PCS inventory.

The elements of the LCO that provide overpressure mitigation throughpressure relief are:

a. Two OPERABLE PORVs; or

b. The PCS depressurized and vented.

A PORV is OPERABLE for LTOP when its block valve is open, its liftsetpoint is set consistent with Figure 3.4.12-1 in the accompanying LCOand testing has proven its ability to open at that setpoint, and motivepower is available to the valve and its control circuit.

A PCS vent is OPERABLE when open with an area capable of relieving:? 167 gpm at a PCS pressure of 315 psia.

Each of these methods of overpressure prevention is capable ofmitigating the limiting LTOP transient.


LTOP SystemB 3.4.12

BASES

APPLICABILITY This LCO is applicable in MODE 3 when the temperature of any PCS coldleg is < 4300 F, in MODES 4 and 5, and in MODE 6 when the reactorvessel head is on. The pressurizer safety valves provide overpressureprotection that meets the Reference 1 P/T limits at and above 430'F.When the reactor vessel head is off, overpressurization cannot occur.

LCO 3.4.3 provides the operational P/T limits for all MODES.LCO 3.4.10, "Pressurizer Safety Valves," requires the OPERABILITY ofthe pressurizer safety valves that provide overpressure protection duringMODES 1 and 2, and MODE 3 with all PCS cold leg temperatures> 4300F.

Low temperature overpressure prevention is most critical duringshutdown when the PCS is water solid, and a mass addition or a heatuptransient can cause a very rapid increase in PCS pressure with little or notime available for operator action to mitigate the event.

ACTIONS A Note prohibits the application of LCO 3.0.4.b to inoperable PORVsused for LTOP. There is an increased risk associated with enteringMODE 4 from MODE 5 with PORVs used for LTOP inoperable and theprovisions of LCO 3.0.4.b, which allow entry into a MODE or otherspecified condition in the Applicability with the LCO not met afterperformance of a risk assessment addressing inoperable systems andcomponents, should not be applied in this circumstance.

A. 1

With one or two HPSI pumps capable of injecting into the PCS,overpressurization is possible.

The immediate Completion Time to initiate actions to restore restrictedcoolant injection capability to the PCS reflects the importance ofmaintaining overpressure protection of the PCS.


LTOP SystemB 3.4.12

BASES

ACTIONS B.1(continued)

With one required PORV inoperable and pressurizer water level < 57%,the required PORV must be restored to OPERABLE status within aCompletion Time of 7 days. Two valves are required to meet the LCOrequirement and to provide low temperature overpressure mitigation whilewithstanding a single failure of an active component.

The Completion Time is based on only one PORV being required tomitigate an overpressure transient, the likelihood of an active failure of theremaining valve path during this time period being very low, and that asteam bubble exists in the pressurizer. Since the pressure response to atransient is greater if the pressurizer steam space is small or if the PCS issolid, the Completion Time for restoration of a PORV flow path to serviceis shorter. The maximum pressurizer level at which credit can be takenfor having a bubble (57%, which provides about 700 cubic feet of steamspace) is based on judgment rather than by analysis. This level providesthe same steam volume to dampen pressure transients as would beavailable at full power. This steam volume provides time for operatoraction (if the PORVs failed to operate) in the interval between aninadvertent SIS and PCS pressure reaching the 10 CFR 50, Appendix Gpressure limit. The time available for action would depend upon theexisting pressure and temperature when the inadvertent SIS occurred.

C.1

The consequences of operational events that will overpressurize the PCSare more severe at lower temperature (Ref. 8). With the pressurizerwater level > 57%, less steam volume is available to dampen pressureincreases resulting from an inadvertent mass injection or heatuptransients. Thus, with one required PORV inoperable and the pressurizerwater level > 57%, the Completion Time to restore the required PORV toOPERABLE status is 24 hours.

The 24 hour Completion Time to restore the required PORV toOPERABLE status when the pressurizer water level is > 57%, whichusually occurs in MODE 5 or in MODE 6 when the vessel head is on, is areasonable amount of time to investigate and repair PORV failureswithout a lengthy period with only one PORV OPERABLE to protectagainst overpressure events.


LTOP SystemB 3.4.12

BASES

ACTIONS D.1(continued)

If two required PORVs are inoperable, or if the Required Actions and theassociated Completion Times are not met, or if the LTOP System isinoperable for any reason other than Condition A, B, or C, the PCS mustbe depressurized and a vent established within 8 hours. The vent mustbe sized to provide a relieving capability of :> 167 gpm at a pressure of315 psia which ensures the flow capacity is greater than that required forthe worst case mass injection transient reasonable during the applicableMODES. This action protects the PCPB from a low temperatureoverpressure event and a possible brittle failure of the reactor vessel.

The Completion Time of 8 hours to depressurize and vent the PCS isbased on the time required to place the plant in this condition and therelatively low probability of an overpressure event during this time perioddue to operator attention and administrative requirements.


To minimize the potential for a low temperature overpressure event bylimiting the mass injection capability, both HPSI pumps are verified to beincapable of injecting into the PCS. The HPSI pumps are renderedincapable of injecting into the PCS by means that assure that a singleevent cannot cause overpressurization of the PCS due to operation of thepump. Typical methods for accomplishing this are by pulling the HPSIpump breaker control power fuses, racking out the HPSI pump motorcircuit breaker, or closing the manual discharge valve.

SR 3.4.12.1 is modified by a Note which only requires the SR to be metwhen complying with LCO 3.4.12.a. When all PCS cold leg temperatureare _> 3000F, a start of both HPSI pumps in conjunction with acharging/letdown imbalance will not cause the PCS pressure to exceedthe 10 CFR 50 Appendix G limits. Thus, this SR is only required whenany PCS cold leg temperature is reduced to less than 3000 F.

The 12 hour interval considers operating practice to regularly assesspotential degradation and to verify operation within the safety analysis.


LTOP SystemB 3.4.12

BASES


(continued) SR 3.4.12.2 requires a verification that the required PCS vent, capable ofrelieving __ 167 gpm at a PCS pressure of 315 psia, is OPERABLE byverifying its open condition either:

a. Once every 12 hours for a valve that is not locked open; or

b. Once every 31 days for a valve that is locked open.

The passive vent arrangement must only be open to be OPERABLE.This Surveillance need only be performed if vent valves are being used tosatisfy the requirements of this LCO. This Surveillance does not need tobe performed for vent paths relying on the removal of a steam generatorprimary manway cover, pressurizer manway cover, safety valve or PORVsince their position is adequately addressed using administrative controlsand the inadvertent reinstallation of these components is unlikely. TheFrequencies consider operating experience with mispositioning ofunlocked and locked vent valves, respectively.

SR 3.4.12.3

The PORV block valve must be verified open every 72 hours to providethe flow path for each required PORV to perform its function whenactuated. The valve can be remotely verified open in the main controlroom.

The block valve is a remotely controlled, motor operated valve. Thepower to the valve motor operator is not required to be removed, and themanual actuator is not required locked in the inactive position. Thus, theblock valve can be closed in the event the PORV develops excessiveleakage or does not close (sticks open) after relieving an overpressureevent.

The 72 hour Frequency considers operating experience with accidentalmovement of valves having remote control and position indicationcapabilities available where easily monitored. These considerationsinclude the administrative controls over main control room access andequipment control.


LTOP SystemB 3.4.12

BASES


SR 3.4.12.4

Performance of a CHANNEL FUNCTIONAL. TEST is required every31 days. A successful test of the required contact(s) of a channel relaymay be performed by the verification of the change of state of a singlecontact of the relay. This clarifies what is an acceptable CHANNELFUNCTIONAL TEST of a relay This is acceptable because all of theTechnical Specifications and non-Technical Specifications tests at leastonce per refueling interval with applicable extensions. PORV actuationcould depressurize the PCS and is not required. The 31 day Frequencyconsiders experience with equipment reliability.

A Note has been added indicating this SR is required to be performed12 hours after decreasing any PCS cold leg temperature to < 430'F. ThisNote allows a discrete period of time to perform the required test withoutdelaying entry into the MODE of Applicability for LTOP. This option maybe exercised in cases where an unplanned shutdown below 430'F isnecessary as a result of a Required Action specifying a plant shutdown,or other plant evolutions requiring an expedited cooldown of the plant.The test must be performed within 12 hours after entering the LTOPMODES.

SR 3.4.12.5

Performance of a CHANNEL CALIBRATION on each required PORVactuation channel is required every 18 months to adjust the entirechannel so that it responds and the valve opens within the required LTOPrange and with accuracy to known input.

The 18 month Frequency considers operating experience with equipmentreliability and is consistent with the typical refueling outage schedule.


LTOP SystemB 3.4.12

BASES

REFERENCES 1.

2.

3.

4.

5.

6.

7.

8.

9.

10 CFR 50, Appendix G

Generic Letter 88-11

CPC Engineering Analysis, EA-A-PAL-92-095-01

CPC Engineering Analysis, EA-TCD-90-01

CPC Engineering Analysis, EA-E-PAL-89-040-1

CPC Corrective Action Document, A-PAL-91-011

FSAR, Section 7.4

Generic Letter 90-06

Engineering Analysis EA-EC27959-01, "Palisades Pressure-Temperature Limit Curves and Upper-Shelf Energy Evaluation,"February 2012


ContainmentB 3.6.1

B 3.6 CONTAINMENT SYSTEMS

B 3.6.1 Containment

BASES

BACKGROUND The containment consists of a concrete structure lined with steel plate,and the penetrations through this structure. The structure is designedto contain fission products that may be released from the reactor corefollowing a design basis Loss of Coolant Accident (LOCA). Additionally,this structure provides shielding from the fission products that may bepresent in the containment atmosphere following accident conditions.

The containment is a reinforced concrete structure with a cylindricalwall, a flat foundation mat, and a shallow dome roof. The foundationslab is reinforced with conventional mild-steel reinforcing. The internalpressure loads on the base slab are resisted by both the external soilpressure and the strength of the reinforced concrete slab. The cylinderwall is prestressed with a post tensioning system in the vertical andhorizontal directions. The dome roof is prestressed utilizing a three-waypost tensioning system. The inside surface of the containment is linedwith a carbon steel liner to ensure a high degree of leak tightness duringoperating and accident conditions.

The concrete structure is required for structural integrity of thecontainment under Design Basis Accident (DBA) conditions. The steelliner and its penetrations establish the leakage limiting boundary of thecontainment. Maintaining the containment OPERABLE limits theleakage of fission product radioactivity from the containment to theenvironment. SR 3.6.1.1 leakage rate requirements comply with10 CFR 50, Appendix J, Option B (Ref. 4) as modified by approvedexemptions.

The isolation devices for containment penetrations are a part of thecontainment leak tight boundary. To maintain this leak tight boundary:

a. All penetrations required to be closed during accident conditionsare either:

1. capable of being closed by an OPERABLE automaticcontainment isolation system, or

2. closed by manual valves, blind flanges, or de-activatedautomatic valves secured in their closed positions, except asprovided in LCO 3.6.3, "Containment Isolation Valves";

Palisades Nuclear Plant B3.6.1 -1 Revised 3/15/2012

ContainmentB 3.6.1

BASES

BACKGROUND b. Each air lock is OPERABLE, except as provided in LCO 3.6.2,(continued) "Containment Air Locks";

c. The equipment hatch is properly closed and sealed.

APPLICABLE The safety design basis for the containment is that the containmentSAFETY ANALYSES must withstand the pressures and temperatures of the limiting DBA

without exceeding the design leakage rate.

A Loss of Coolant Accident (LOCA) and a control rod ejection accidentare the two DBAs that are analyzed for release of fission products withincontainment (Ref. 1). In the analysis of each of these accidents, it isassumed that containment is OPERABLE such that release of fissionproducts to the environment is controlled by the rate of containmentleakage. The containment was designed with an allowable leakage rateof 0.10% of containment air weight per day at a design pressure of55 psig and a design temperature of 283oF (Ref. 3).

Satisfactory leakage rate test results are a requirement for theestablishment of containment OPERABILITY.

The containment satisfies Criterion 3 of 10 CFR 50.36(c)(2).

LCO Containment OPERABILITY is maintained by limiting leakage to< 1.0 La, except prior to the first startup after performing a requiredContainment Leak Rate Testing Program leakage test. At this time, theapplicable leakage limits must be met.

Technical Specification ADMIN 5.5.14 defines La as the maximumallowable leakage rate at pressure Pa. The Pa value of 54.2 psigrepresents the analytical value for a large break LOCA found inReference 1.

Compliance with this LCO will ensure a containment configuration,including the equipment hatch, that is structurally sound and that willlimit leakage to those leakage rates assumed in the safety analysis.

Palisades Nuclear Plant B3.6.1-2 Revised 3/15/2012

ContainmentB 3.6.1

BASES

LCO(continued)

Individual leakage rates that may be specified for the containment airlock (LCO 3.6.2) and purge valves which have resilient seals(LCO 3.6.3) are not specifically part of the acceptance criteria of10 CFR 50, Appendix J. Therefore, leakage rates exceeding theseindividual limits only result in the containment being inoperable whenthe leakage results in exceeding the overall acceptance criteria of1.0 La.

APPLICABILITY In MODES 1,2, 3, and 4, a DBA could cause a release of fissionproducts into containment. In MODES 5 and 6, the probability andconsequences of these events are reduced due to the pressure andtemperature limitations of these MODES. Therefore, containment is notrequired to be OPERABLE in MODE 5 to prevent leakage of fissionproducts from containment. The requirements for containment duringMODE 6 are addressed in LCO 3.9.3, "Containment Penetrations."'

ACTIONS A.1

In the event containment is inoperable, containment must be restored toOPERABLE status within 1 hour. The 1 hour Completion Time providesa period of time to correct the problem commensurate with theimportance of maintaining containment OPERABILITY duringMODES 1, 2, 3, and 4. This time period also ensures that theprobability of an accident (requiring containment OPERABILITY)occurring, during periods when containment is inoperable, is minimal.

B.1 and B.2

If containment cannot be restored to OPERABLE status within therequired Completion Time, the plant must be brought to a MODE inwhich the LCO does not apply. To achieve this status, the plant mustbe brought to at least MODE 3 within 6 hours and to MODE 5 within36 hours. The allowed Completion Times are reasonable, based onoperating experience, to reach the required plant conditions from fullpower conditions in an orderly manner and without challenging plantsystems.

Palisades Nuclear Plant B3.6.1-3 Revised 3/15/2012

ContainmentB 3.6.1

BASES


Maintaining the containment OPERABLE requires compliance with thevisual examinations and leakage rate test requirements of theContainment Leak Rate Testing Program. Failure to meet individual airlock and containment isolation valve "local leak rate" leakage limits doesnot invalidate the acceptability of the overall leakage determinationunless their contribution to overall Type A, B, or C leakage causes thatleakage to exceed limits. As left leakage prior to the first startup afterperforming a required Containment Leak Rate Testing Program leakagetest is required to be < 0.6 La for combined B and C leakage, and< 0.75 La for overall Type A leakage. At all other times betweenrequired leakage rate tests, the acceptance criteria is based on anoverall Type A leakage limit of _ 1.0 La. At < 1.0 La the offsite doseconsequences are bounded by the assumptions of the safety analysis.SR Frequencies are as required by the Containment Leak Rate TestingProgram. These periodic testing requirements verify that thecontainment leakage rate does not exceed the leakage rate assumed inthe safety analysis.

SR 3.6.1.2

This SR ensures that the structural integrity of the containment will bemaintained in accordance with the provisions of the ContainmentStructural Integrity Surveillance Program.

REFERENCES 1. FSAR, Chapter 14



4. 10 CFR 50, Appendix J, Option B


Containment Air LocksB 3.6.2


B 3.6.2 Containment Air Locks

BASES

BACKGROUND Containment air locks form part of the containment pressure boundaryand provide a means for personnel access during all MODES ofoperation.

Two air locks provide access into the containment. Each air lock isnominally a right circular cylinder, with a door at each end. The personnelair lock doors are 3 foot, 6 inches by 6 foot, 8 inches. The emergencyescape air lock doors are 30 inches in diameter. The doors areinterlocked to prevent simultaneous opening. During periods whencontainment is not required to be OPERABLE, the door interlockmechanism may be disabled, allowing both doors of an air lock to remainopen for extended periods when frequent containment entry is necessary.Each air lock door has been designed and tested to certify its ability towithstand a pressure in excess of the maximum expected pressurefollowing a Design Basis Accident (DBA) in containment. As such,closure of a single door supports containment OPERABILITY. Each ofthe doors contains double gasketed seals and local testing capability toensure pressure integrity. To effect a leak tight seal, the air lock designuses pressure seated doors (i.e., an increase in containment internalpressure results in increased sealing force on each door).

Air lock integrity and leak tightness are essential for maintaining thecontainment leakage rate within limit in the event of a DBA. Notmaintaining air lock integrity or leak tightness may result in a leakage ratein excess of that assumed in the plant safety analysis.



BASES


A Loss of Coolant Accident (LOCA) and a control rod ejection accidentare the two DBAs that are analyzed for release of fission products withincontainment (Ref. 1). In the analysis of each of these accidents, it isassumed that containment is OPERABLE such that release of fissionproducts to the environment is controlled by the rate of containmentleakage. The containment was designed with an allowable leakage rateof 0.10% of containment air weight per day at a design pressure of55 psig and a design temperature of 283°F (Ref. 2). This allowableleakage rate forms the basis for the acceptance criteria imposed on theSRs associated with the air lock.

The containment air locks satisfy Criterion 3 of 10 CFR 50.36(c)(2).

LCO Each containment air lock forms part of the containment pressureboundary. As part of the containment pressure boundary, the air locksafety function is related to limiting the containment leakage rate to< 1.0 La. Thus, each air lock's structural integrity and leak tightness areessential to the successful mitigation of such an event.

Technical Specification ADMIN 5.5.14 defines La as the maximumallowable leakage rate at pressure Pa. The Pa value of 54.2 psigrepresents the analytical value for a large break LOCA found inReference 1.

Each air lock is required to be OPERABLE. For the air lock to beconsidered OPERABLE, the air lock interlock mechanism must beOPERABLE, the air lock must be in compliance with the Type B air lockleakage test, and both air lock doors must be OPERABLE. The interlockallows only one air lock door of an air lock to be opened at one time. Thisprovision ensures that a gross breach of containment does not exist whencontainment is required to be OPERABLE. Closure of a singleOPERABLE door in each air lock is sufficient to provide a leak tightbarrier following postulated events. Nevertheless, both doors are keptclosed when the air lock is not being used for normal entry into or exitfrom containment. Air lock test connection isolation valves areconsidered to be part of the associated air lock outer door.



BASES

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of fission productsto containment. In MODES 5 and.6, the probability and consequences ofthese events are reduced due to the pressure and temperature limitationsof these MODES. Therefore, the containment air locks are not required inMODE 5 to prevent leakage of fission products from containment. Therequirements for the containment air locks during MODE 6 are addressedin LCO 3.9.3, "Containment Penetrations."

ACTIONS The ACTIONS are modified by three notes. The first note allows entryand exit to perform repairs on the affected air lock component. If theouter door is inoperable, then it may be easily accessed for most repairs.It is preferred that the air lock be accessed from inside containment byentering through the other OPERABLE air lock. However, if this is notpracticable, or if repairs on either door must be performed from the barrelside of the door then it is permissible to enter the air lock through theOPERABLE door, even if this door has been locked to comply withACTIONS. This means there is a short time during which thecontainment boundary is not intact (during access through theOPERABLE door). The ability to open the OPERABLE door, even if itmeans the containment boundary is temporarily not intact, is acceptablebecause of the low probability of an event that could pressurize thecontainment during the short time in which the OPERABLE door isexpected to be open. After each entry and exit, the OPERABLE doormust be immediately closed. If ALARA conditions permit, entry and exitshould be via an OPERABLE air lock.

A second Note has been added to provide clarification that, for this LCO,separate Condition entry is allowed for each air lock. This is acceptable,since the Required Actions for each Condition provide appropriatecompensatory actions for each inoperable air lock. Complying with theRequired Actions may allow for continued operation, and a subsequentinoperable air lock is governed by subsequent Condition entry andapplication of associated Required Actions. A third Note has beenincluded that requires entry into the applicable Conditions and RequiredActions of LCO 3.6.1, "Containment," when leakage results in exceedingthe overall containment leakage limit.




BASES

ACTIONS A.1, A.2. and A.3(continued)

With one air lock door inoperable in one or more containment air locks,the OPERABLE door must be verified closed (Required Action A.1) ineach affected containment air lock. This ensures that a leak tightcontainment barrier is maintained by the use of an OPERABLE air lockdoor. This action must be completed within 1 hour. This specified timeperiod is consistent with the ACTIONS of LCO 3.6.1, which requirescontainment be restored to OPERABLE status within 1 hour.

In addition, the affected air lock penetration must be isolated by lockingclosed an OPERABLE air lock door within the 24 hour Completion Time.The 24 hour Completion Time is considered reasonable for locking theOPERABLE air lock door, considering the OPERABLE door of theaffected air lock is being maintained closed.

Required Action A.3 verifies that an air lock with an inoperable door hasbeen isolated by the use of a locked and closed OPERABLE air lockdoor. This ensures that an acceptable containment leakage barrier ismaintained. Required Action A.3 is modified by a Note that applies to airlock doors located in high radiation areas and allows these doors to beverified locked closed by use of administrative means. Allowingverification by administrative means is considered acceptable, sinceaccess to these areas is typically restricted. Therefore, the probability ofmisalignment of the door, once it has been verified to be in the properposition, is small.

The Completion Time of once per 31 days is based on engineeringjudgment and is considered adequate in view of the low likelihood of alocked door being mispositioned and other administrative controls. Asstated in SR 3.0.2, the 25% extension allowed by SR 3.0.2 may beapplied to Required Actions whose Completion Time is stated as "onceper..." however, the 25% extension does not apply to the initialperformance of a Required Action with a periodic Completion Time thatrequires performance on a "once per.. ." basis. The 25% extensionapplies to each performance of the Required Action after the initialperformance. Therefore, while Required Action 3.6.2 A.3 must be initiallyperformed within 31 days without any SR 3.0.2 extension, subsequentperformances may utilize the 25% SR 3.0.2 extension.



BASES

ACTIONS A.1, A.2, and A.3 (continued)

The Required Actions have been modified by two Notes. Note 1 ensuresthat only the Required Actions and associated Completion Times ofCondition C are required if both doors in the same air lock are inoperable.With both doors in the same air lock inoperable, an OPERABLE door isnot available to be closed. Required Actions C.1 and C.2 are theappropriate remedial actions. The exception provided by Note 1 does notaffect tracking the Completion Time from the initial entry into Condition A;only the requirement to comply with the Required Actions.

Note 2 allows use of the air lock for entry and exit for 7 days underadministrative controls if both air locks have an inoperable door. This7 day restriction begins when the second air lock is discoveredinoperable. Containment entry may be required to perform TechnicalSpecifications (TS) Surveillances and Required Actions, as well as otheractivities on equipment inside containment that are required by TS oractivities on equipment that support TS-required equipment. This Note isnot intended to preclude performing other activities (i.e., non-TS-requiredactivities) if the containment was entered, using the inoperable air lock, toperform an allowed activity listed above. This allowance is acceptabledue to the low probability of an event that could pressurize thecontainment during the short time that the OPERABLE door is expectedto be open.

B.1, B.2, and B.3

With an air lock interlock mechanism inoperable in one or more air locks,the Required Actions and associated Completion Times are consistentwith those specified in Condition A.

The Required Actions have been modified by two Notes. Note 1 ensuresthat only the Required Actions and associated Completion Times ofCondition C are required if both doors in the same air lock are inoperable.With both doors in the same air lock inoperable, an OPERABLE door isnot available to be closed. Required Actions C.1 and C.2 are theappropriate remedial actions. Note 2 allows entry into and exit fromcontainment under the control of a dedicated individual stationed at theair lock to ensure that only one door is opened at a time (i.e., theindividual performs the function of the interlock).



BASES

ACTIONS B.1, B.2, and B.3 (continued)

Required Action B.3 is modified by a Note that applies to air lock doorslocated in high radiation areas and allows these doors to be verifiedlocked closed by use of administrative means. Allowing verification byadministrative means is considered acceptable, since access to theseareas is typically restricted. Therefore, the probability of misalignment ofthe door, once it has been verified to be in the proper position, is small.

C.1, C.2, and C.3

With one or more air locks inoperable for reasons other than thosedescribed in Condition A or B, Required Action C.1 requires action to beinitiated immediately to evaluate previous combined leakage rates usingcurrent air lock test results. If the overall containment leakage rateexceeds the limits of LCO 3.6.1, the conditions of that LCO must beentered in accordance with Actions Note 3. An evaluation is acceptablesince it is overly conservative to immediately declare the containmentinoperable if both doors in an air lock have failed a seal test or if theoverall air lock leakage is not within limits. In many instances (e.g., onlyone seal per door has failed), containment remains OPERABLE, yet only1 hour (per LCO 3.6.1) would be provided to restore the air lock door toOPERABLE status prior to requiring a plant shutdown. In addition, evenwith both doors failing the seal test, the overall containment leakage ratecan still be within limits.

Required Action C.2 requires that one door in the affected containment airlock must be verified to be closed. This action must be completed withinthe 1 hour Completion Time. This specified time period is consistent withthe ACTIONS of LCO 3.6.1, which requires that containment be restoredto OPERABLE status within 1 hour.

Additionally, the affected air lock(s) must be restored to OPERABLEstatus within the 24 hour Completion Time. The specified time period isconsidered reasonable for restoring an inoperable air lock to OPERABLEstatus, assuming that at least one door is maintained closed in eachaffected air lock.



BASES

ACTIONS D.1 and D.2(continued)

If the inoperable containment air lock cannot be restored to OPERABLEstatus within the required Completion Time, the plant must be brought toa MODE in which the LCO does not apply. To achieve this status, theplant must be brought to at least MODE 3 within 6 hours and to MODE 5within 36 hours. The allowed Completion Times are reasonable, basedon operating experience, to reach the required plant conditions from fullpower conditions in an orderly manner and without challenging plantsystems.


Maintaining containment air locks OPERABLE requires compliance withthe leakage rate test requirements of the Containment Leak Rate TestingProgram.

This SR reflects the leakage rate testing requirements with regard to airlock leakage (Type B leakage tests). The acceptance criteria, wereestablished during initial air lock and containment Operability testing.Subsequent amendments to the Technical Specifications revised theacceptance criteria for overall Type B and C leakage limits and providednew acceptance criteria for the personnel air lock doors and theemergency air lock doors (Ref. 2). The periodic testing requirementsverify that the air lock leakage does not exceed the allowed fraction of theoverall containment leakage rate. The Frequency is required by theContainment Leak Rate Testing Program.

The SR has been modified by two Notes. Note 1 states that aninoperable air lock door does not invalidate the previous successfulperformance of the overall air lock leakage test. This is consideredreasonable since either air lock door is capable of providing a fissionproduct barrier in the event of a DBA. Note 2 has been added to this SRrequiring the results to be evaluated against the acceptance criteria ofSR 3.6.1.1. This ensures that air lock leakage is properly accounted forin determining the combined Type B and C containment leakage rate.



BASES


(continued)

SR 3.6.2.2

The air lock interlock is designed to prevent simultaneous opening of bothdoors in a single air lock. Since both the inner and outer doors of an airlock are designed to withstand the maximum expected post accidentcontainment pressure, closure of either door will support containmentOPERABILITY. Thus, the door interlock feature supports containmentOPERABILITY while the air lock is being used for personnel transit intoand out of containment. Periodic testing of this interlock demonstratesthat the interlock will function as designed and that simultaneous openingof the inner and outer doors will not inadvertently occur. Due to thepurely mechanical nature of this interlock, and given that the interlockmechanism is not normally challenged when the airlock is used for entryand exit (procedures require strict adherence to single door opening), thistest is only required to be performed every 24 months.

The 24 month Frequency for the interlock is justified based on genericoperating experience. The Frequency is based on engineering judgmentand is considered adequate given that the interlock is not normallychallenged during use of the airlock.

REFERENCES 1. FSAR, Chapter 14


3. 10 CFR 50, Appendix J, Option B


Containment PressureB 3.6.4


B 3.6.4 Containment Pressure

BASES

BACKGROUND The containment pressure is limited during normal operation to preservethe initial conditions assumed in the accident analyses for a Loss ofCoolant Accident (LOCA) or Main Steam Line Break (MSLB).

Containment pressure is a process variable that is monitored andcontrolled. The containment pressure limits are derived from the inputconditions used in the containment functional analyses. Should operationoccur outside these limits coincident with a Design Basis Accident (DBA),post accident containment pressures could exceed calculated values.


Containment internal pressure is an initial condition used in the DBAanalyses to establish the maximum peak containment internal pressure.The limiting DBAs considered for determining the maximum containmentinternal pressure are the LOCA and MSLB. A large break LOCA resultsin the highest calculated internal containment pressure of 54.2 psig,which is below the internal design pressure of 55 psig. The postulatedDBAs are analyzed assuming degraded containment Engineered SafetyFeature (ESF) systems (i.e., assuming the limiting single active failure).See the Bases for 3.6.1, "Containment," for a discussion on containmentpressures resulting from a LOCA.

The initial pressure condition used in the containment analysis was15.7 psia (1.0 psig) in MODES 1 and 2 and 16.2 psia (1.5 psig in MODES3 and 4). The LCO limits of 1.0 psig in MODES 1 and 2, and 1.5 psig inMODES 3 and 4 ensures that, in the event of an accident, the maximumaccident design pressure for containment, 55 psig, is not exceeded.

A higher containment pressure limit is allowed in MODES 3 and 4 wherethe reactor is not critical and the resulting heat addition to containment ina DBA is lower.



BASES

APPLICABLE The external design pressure of the containment shell is 3 psig. ThisSAFETY ANALYSES value is approximately 0.5 psig greater than the maximum external

(continued) pressure that could be developed if the containment were sealed during aperiod of low barometric pressure and high temperature and,subsequently, the containment atmosphere were cooled with a concurrentmajor rise in barometric pressure. Vacuum breakers are, therefore, notprovided and no minimum containment pressure specification is required.

Containment pressure satisfies Criterion 2 of 10 CFR 50.36(c)(2).

LCO Maintaining containment pressure less than or equal to the LCO upperpressure limit ensures that, in the event of a DBA, the resultant peakcontainment accident pressure will remain below the containment designpressure. Two limits for containment pressure are provided to reflect theanalyses which allow for a higher containment pressure when the reactoris not critical due to less heat input to containment in the event of a DBA.

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactivematerial to containment. Since maintaining containment pressure withinlimits is essential to ensure initial conditions assumed in the accidentanalysis are maintained, the LCO is applicable in MODES 1, 2, 3, and 4.

In MODES 5 and 6, the probability and consequences of these events arereduced due to the pressure and temperature limitations of theseMODES. Therefore, maintaining containment pressure within the limits ofthe LCO is not required in MODE 5 or 6.

ACTIONS A.1

When containment pressure is not within the limits of the LCO,containment pressure must be restored to within these limits within1 hour. The Required Action is necessary to return operation to within thebounds of the containment analysis. The 1 hour Completion Time isconsistent with the ACTIONS of LCO 3.6.1, "Containment," whichrequires that containment be restored to OPERABLE status within 1 hour.



BASES

ACTIONS B.1 and B.2(continued)

If containment pressure cannot be restored to within limits within therequired Completion Time, the plant must be brought to a MODE in whichthe LCO does not apply. To achieve this status, the plant must bebrought to at least MODE 3 within 6 hours and to MODE 5 within36 hours. The allowed Completion Times are reasonable, based onoperating experience, to reach the required plant conditions from fullpower conditions in an orderly manner and without challenging plantsystems.


Verifying that containment pressure is within limits ensures that operationremains within the limits assumed in the accident analyses. The 12 hourFrequency of this SR was developed after taking into considerationoperating experience related to trending of containment pressurevariations during the applicable MODES. Furthermore, the 12 hourFrequency is considered adequate in view of other indications available inthe control room, including alarms, to alert the operator to an abnormalcontainment pressure condition. The limit of 1.0 psig for MODES 1 and 2,1.5 psig for MODES 3 and 4 are the actual limits used in the accidentanalysis and do not account for instrument inaccuracies.

REFERENCES 1. FSAR, Section 14.18


Containment Air TemperatureB 3.6.5


B 3.6.5 Containment Air Temperature

BASES

BACKGROUND The containment structure serves to contain radioactive material that maybe released from the reactor core following a Design Basis Accident(DBA). The containment average air temperature is limited during normaloperation to preserve the initial conditions assumed in the accidentanalyses for a Loss of Coolant Accident (LOCA) or Main Steam LineBreak (MSLB).

Containment air temperature is a process variable that is monitored andcontrolled. The containment average air temperature limit is derived fromthe input conditions used in the containment accident analyses. ThisLCO ensures that initial conditions assumed in the analysis ofcontainment response to a DBA are not violated during plant operations.The total amount of energy to be removed from containment by theContainment Spray and Cooling systems during post accident conditionsis dependent on the energy released to the containment due to the event,as well as the initial containment temperature and pressure. The higherthe initial temperature, the more energy that must be removed, resultingin a higher peak containment pressure and temperature. Exceedingcontainment design pressure may result in leakage greater than thatassumed in the accident analysis (Ref. 1). Operation with containmentaverage air temperature in excess of the LCO limit may result in an initialcondition higher than that assumed in the accident analysis.


Containment average air temperature is an initial condition used in theDBA analyses that establishes the containment environmentalqualification operating envelope for both pressure and temperature. Thelimit for containment average air temperature ensures that operation ismaintained within the assumptions used in the DBA analysis forcontainment. The accident analyses and evaluations considered bothLOCAs and MSLBs for determining the maximum peak containmentpressures and temperatures. The LOCA event is bounding with respectto peak containment pressure, and the MSLB event is bounding withrespect to peak containment temperature. This is due to the differences inthe magnitude and timing of the mass and energy release rates betweenthe two events. The LOCA peak pressure occurs prior to any containmentheat removal components being placed in service. The MSLB peaktemperature occurs after heat removal equipment has been in operation.

The initial pre-accident temperature inside containment was assumed tobe 145°F to provide analysis margin from the Technical Specification limitof 140OF (Ref. 2).



BASES

APPLICABLE Containment average air temperature satisfies Criterion 2 ofANALYSES SAFETY 10 CFR 50.36(c)(2).(continued)

LCO During a DBA, with an initial containment average air temperature lessthan or equal to the LCO temperature limit, the resultant peak accidentpressure is maintained below the containment design pressure. As aresult, the ability of containment to perform its function is ensured.

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactivematerial to containment. In MODES 5 and 6, the probability andconsequences of these events are reduced due to the pressure andtemperature limitations of these MODES. Therefore, maintainingcontainment average air temperature within the limit is not required inMODE 5 or 6.

ACTIONS A.1

When containment average air temperature is not within the limit of theLCO, it must be restored to within limit within 8 hours. This RequiredAction is necessary to return operation to within the bounds of thecontainment analysis. The 8 hour Completion Time is acceptableconsidering the sensitivity of the analysis to variations in this parameterand provides sufficient time to correct minor problems.



BASES

ACTIONS B.1 and B.2(continued)

If the containment average air temperature cannot be restored to withinits limit within the required Completion Time, the plant must be brought toa MODE in which the LCO does not apply. To achieve this status, theplant must be brought to at least MODE 3 within 6 hours and to MODE 5within 36 hours. The allowed Completion Times are reasonable, basedon operating experience, to reach the required plant conditions from fullpower conditions in an orderly manner and without challenging plantsystems.


Verifying that containment average air temperature is within the LCO limitensures that containment operation remains within the limit assumed forthe containment analyses. The 145°F limit is the actual limit assumed forthe accident analyses and does not account for instrument inaccuracies.Instrument uncertainties are accounted for in the surveillance procedure.The 24 hour Frequency of this SR is considered acceptable based on theobserved slow rates of temperature increase within containment as aresult of environmental heat sources (due to the large volume ofcontainment).




Containment Cooling SystemsB 3.6.6


B 3.6.6 Containment Cooling Systems

BASES

BACKGROUND The Containment Spray and Containment Air Cooler systems providecontainment atmosphere cooling to limit post accident pressure andtemperature in containment to less than the design values. Reduction ofcontainment pressure reduces the release of fission product radioactivityfrom containment to the environment, in the event of a Main Steam LineBreak (MSLB) or a large break Loss of Coolant Accident (LOCA). TheContainment Spray and Containment Air Cooler systems are designed tothe requirements of the Palisades Nuclear Plant design criteria (Ref. 1).

The Containment Air Cooler System and Containment Spray System areEngineered Safety Feature (ESF) systems. They are designed to ensurethat the heat removal capability required during the post accident periodcan be attained. The systems are arranged with two spray pumpspowered from one diesel generator, and with one spray pump and threeair cooler fans powered from the other diesel generator. TheContainment Spray System was originally designed to be redundant tothe Containment Air Coolers (CACs) and fans. These systems wereoriginally designed such that either two containment spray pumps or threeCACs could limit containment pressure to less than design. However, thecurrent safety analyses take credit for one containment spray pump whenevaluating cases with three CACs, and no air cooler fans in cases withtwo spray pumps and both Main Steam Isolation Valve (MSIV) bypassvalves closed. If an MSIV bypass valve is open, 2 service water pumpsand 2 CACs are also required to be OPERABLE in addition to the 2 spraypumps for containment heat removal.

To address this dependency between the Containment Spray System andthe Containment Air Cooler System the title of this Specification is"Containment Cooling Systems," and includes both systems. The LCO iswritten in terms of trains of containment cooling. One train of containmentcooling is associated with Diesel Generator 1-1 and includes ContainmentSpray Pumps P-54B and P-54C, Containment Spray Valve CV-3001 andthe associated spray header. The other train of containment cooling isassociated with Diesel Generator 1-2 and includes Containment SprayPump P-54A, Containment Spray Valve CV-.3002 and the associatedspray header, and CACs VHX-1, VHX-2, and VHX-3 and their associatedsafety related fans, V-1A, V-2A, and V-3A.



BASES

BACKGROUND If reliance is placed solely on one spray pump and three CACs, at least(continued) two service water pumps must be OPERABLE to provide the necessary

service water flow to assure OPERABILITY of the CACs. Additionaldetails of the required equipment and its operation is discussed with thecontainment cooling system with which it is associated.

Containment Spray System

The Containment Spray System consists of three half-capacity (50%)motor driven pumps, two shutdown cooling heat exchangers, two sprayheaders, two full sets of full capacity (100%) nozzles, valves, and piping,two full capacity (100%) pump suction lines from the Safety Injection andRefueling Water Tank (SIRWT) and the containment sump with theassociated piping, valves, power sources, instruments, and controls. Theheat exchangers are shared with the Shutdown Cooling System. SIRWTsupplies borated water to the containment spray during the injectionphase of operation. In the recirculation mode of operation, containmentspray pump suction is transferred from the SIRWT to the containmentsump.

Normally, both Shutdown Cooling Heat Exchangers must be available toprovide cooling of the containment spray flow in the event of a Loss ofCoolant Accident. If the Containment Spray side (tube side) of one SDCHeat Exchanger is out of service, 100% of the required post accidentcooling capability can be provided, if other equipment outages are limited(refer to Bases for Required Action C.1).

The Containment Spray System provides a spray of cold borated waterinto the upper regions of containment to reduce the containment pressureand temperature during a MSLB or large break LOCA event. In addition,the Containment Spray System in conjunction with the use of sodiumTetraborate (LCO 3.5.5, "Containment Sump Buffering Agent and WeightRequirements,") serve to remove iodine which may be released followingan accident. The SIRWT solution temperature is an important factor indetermining the heat removal capability of the Containment Spray Systemduring the injection phase.



BASES

BACKGROUND Containment Spray System (continued)

In the recirculation mode of operation, heat is removed from thecontainment sump water by the shutdown cooling heat exchangers.

The Containment Spray System is actuated either automatically by aContainment High Pressure (CHP) signal or manually. An automaticactuation opens the containment spray header isolation valves, starts thethree containment spray pumps, and begins the injection phase.Individual component controls may be used to manually initiateContainment Spray. The injection phase continues until an SIRWT LevelLow signal is received. The Low Level signal for the SIRWT generates aRecirculation Actuation Signal (RAS) that aligns valves from thecontainment spray pump suction to the containment sump. RAS re-positions CV-3001 and CV-3002 to a predetermined throttled position toensure adequate containment spray pump NPSH. RAS opens the HPSIsubcooling valve CV-3071, if the associated HPSI pump is operating.After the containment sump valve CV-3030 opens from RAS, HPSIsubcooling valve CV-3070 will open, if the associated HPSI pump isoperating. RAS will close containment spray valve CV-3001, ifcontainment sump valve CV-3030 does not open. The ContainmentSpray System in recirculation mode maintains an equilibrium temperaturebetween the containment atmosphere and the recirculated sump water.Operation of the Containment Spray System in the recirculation mode iscontrolled by the operator in accordance with the emergency operatingprocedures.

The containment spray pumps also provide a required support functionfor the High Pressure Safety Injection pumps as described in the Basesfor specification 3.5.2. The High Pressure Safety Injection pumps alonemay not have adequate NPSH after a postulated accident and therealignment of their suctions from the SIRWT to the containment sump.Flow is automatically provided from the discharge of the containmentspray pumps to the suction of the High Pressure Safety Injection (HPSI)pumps after the change to recirculation mode has occurred, if the HPSIpump is operating. The additional suction pressure ensures thatadequate NPSH is available for the High Pressure Safety Injectionpumps.



BASES

BACKGROUND Containment Air Cooler System(continued)

The Containment Air Cooler System includes four air handling andcooling units, referred to as the Containment Air Coolers (CACs), whichare located entirely within the containment building. Three of the CACs(VHX-1, VHX-2, and VHX-3) are safety related coolers and are cooled bythe critical service water. The fourth CAC (VHX-4) is not taken credit forin maintaining containment temperature within limit (the service waterinlet valve for VHX-4 is closed by an SIS signal to conserve service waterflow), but is used during normal operation along with the three CACs tomaintain containment temperature below the design limits.

The DG which powers the fans associated with VHX-1, VHX-2, andVHX-3 (V-1A, V-2A and V-3A) also powers two service water pumps.This is necessary because if reliance is placed solely on the train withone spray pump and three CACs, at least two service water pumps mustbe OPERABLE to provide the necessary service water flow to assureOPERABILITY of the CACs.

Each CAC has two vaneaxial fans with direct connected motors whichdraw air through the cooling coils. Both of these fans are normally inoperation, but only one fan and motor for each CAC is rated for postaccident conditions. The post accident rated "safety related" fan units,V-1A, V-2A, and V-3A, serve to provide forced flow for the associatedcooler. A single operating safety related spray header will provideenough air flow to assure that there is adequate mixing of unsprayedcontainment areas to assure the assumed iodine removal by thecontainment spray. In post accident operation following a SIS, all fourContainment air coolers are designed to change automatically to theemergency mode.

The CACs are automatically changed to the emergency mode by a SafetyInjection Signal (SIS). This signal will trip the normal rated fan motor ineach unit, open the high-capacity service water discharge valve fromVHX-1, VHX-2, and VHX-3, and close the high-capacity service watersupply valve to VHX-4. The test to verify the service water valves actuateto their correct position upon receipt of an SIS signal is included in thesurveillance test performed as part of Specification 3.7.8, "Service WaterSystem." The safety related fans and the V-4A non-safety related fan arenormally in operation and only receive an actuation signal through theDBA sequencers following an SIS in conjunction with a loss of offsitepower. This actuation is tested by the surveillance which verifies theenergizing of loads from the DBA sequencers in Specification 3.8.1, "ACSources-Operating."



BASES

APPLICABLE The Containment Spray System and Containment Air CoolerSAFETY ANALYSES System limit the temperature and pressure that could be experienced

following either a Loss of Coolant Accident (LOCA) or a Main Steam LineBreak (MSLB). The large break LOCA and MSLB are analyzed usingcomputer codes designed to predict the resultant containment pressureand temperature transients.

The Containment Cooling Systems have been analyzed for three accidentcases (Ref. 2). All accidents analyses account for the most limiting singleactive failure.

1. A Large Break LOCA concurrent with a loss of offsite power,

2. An MSLB occurring at various power levels with both MSIV bypassvalves closed with offsite power available, and

3. An MSLB occurring at 0% RTP with both MSIV bypass valvesopen, both with and without offsite power available.

The postulated large break LOCA is analyzed, in regard to containmentESF systems, assuming the loss of offsite power and the loss of one ESFbus, which is the worst case single active failure, resulting in one train ofContainment Cooling being rendered inoperable (Ref. 6).

The postulated MSLB is analyzed, in regard to containment ESF systems,assuming the worst case single active failure.

The MSLB event is analyzed at various power levels with both MSIVbypass valves closed, and at 0% RTP (MODE 2) with both MSIV bypassvalves open. Having any MSIV bypass valve open allows additionalblowdown from the intact steam generator. These cases consider singleactive failure scenarios both with and without offsite power available.With offsite power available, the analysis evaluates failure of variousrelays responsible for starting containment heat removal components onreceipt of SIS or CHP signals. On loss of offsite power, the analysisevaluates failure of an emergency diesel generator resulting in one trainof containment cooling being rendered inoperable. Generally, cases withoffsite power available are bounding as the primary coolant pumpsremain in service resulting in forced convection through the steamgenerators increasing the blowdown energy.



BASES

APPLICABLEANALYSES

(continued)

The analysis and evaluation show that under the worst-case scenario, thehighest peak containment pressure and the peak containment vaportemperature are within the design basis. (See the Bases forSpecifications 3.6.4, "Containment Pressure," and 3.6.5, "Containment AirTemperature," for a detailed discussion.) The analyses and evaluationsconsidered a range of power levels and equipment configurations asdescribed in Reference 2. The peak containment pressure case is thelarge break LOCA with initial (pre-accident) conditions of 145°F and15.7 psia. The peak temperature case is the 0% power MSLB with initial(pre-accident) conditions of 145°F and 16.2 psia. The analyses alsoassume a response time delayed initiation in order to provideconservative peak calculated containment pressure and temperatureresponses.

The external design pressure of the containment shell is 3 psig. Thisvalue is approximately 0.5 psig greater than the maximum externalpressure that could be developed if the containment were sealed during aperiod of low barometric pressure and high temperature and,subsequently, the containment atmosphere was cooled with a concurrentmajor rise in barometric pressure.

The modeled Containment Cooling System actuation from thecontainment analysis is based on a response time associated withexceeding the Containment High Pressure setpoint to achieve full flowthrough the CACs and containment spray nozzles. The spray lines withincontainment are maintained filled to the 735 ft elevation to provide forrapid spray initiation. The Containment Cooling System total responsetime of < 60 seconds includes diesel generator startup (for loss of offsitepower), loading of equipment, CAC and containment spray pump startup,and spray line filling.

The performance of the Containment Spray System for post accidentconditions is given in Reference 3. The performance of the ContainmentAir Coolers is given in Reference 4.

The Containment Spray System and the Containment Cooling Systemsatisfy Criterion 3 of 10 CFR 50.36(c)(2).



BASES

LCO During an MSLB or large break LOCA event, a minimum of onecontainment cooling train is required to maintain the containment peakpressure and temperature below the design limits (Ref. 2). One train ofcontainment cooling is associated with Diesel Generator 1-1 and includesContainment Spray Pumps P-54B and P-54C, Containment Spray ValveCV-3001 and the associated spray header. This train must besupplemented with 2 service water pumps and 2 containment air coolersif an MSIV bypass valve is open. The other train of containment coolingis associated with Diesel Generator 1-2 and includes Containment SprayLCO Pump P-54A, Containment Spray Valve CV-3002 and theassociated spray header, and CACs VHX-1, VHX-2, and VHX-3 and theirassociated safety related fans, V-1A, V-2A, and V-3A. To ensure thatthese requirements are met, two trains of containment cooling must beOPERABLE. Therefore, in the event of an accident, the minimumrequirements are met, assuming the worst-case single active failureoccurs.

The Containment Spray System portion of the containment cooling trainsincludes three spray pumps, two spray headers, nozzles, valves, piping,instruments, and controls to ensure an OPERABLE flow path capable oftaking suction from the SIRWT upon an ESF actuation signal andautomatically transferring suction to the containment sump.

The Containment Air Cooler System portion of the containment coolingtrain which must be OPERABLE includes the three safety related aircoolers which each consist of four cooling coil banks, the safety relatedfan which must be in operation to be OPERABLE, gravity-operated fandischarge dampers, instruments, and controls to ensure an OPERABLEflow path.

CAC fans V-1A, V-2A, and V-3A, must be in operation to be consideredOPERABLE. These fans only receive a start signal from the DBAsequencer; they are assumed to be in operation, and are not started byeither a CHP or an SIS signal.

APPLICABILITY In MODES 1, 2, and 3, a large break LOCA event could cause a releaseof radioactive material to containment and an increase in containmentpressure and temperature requiring the operation of the containmentspray trains and containment cooling trains.

In MODES 4, 5 and 6, the probability and consequences of these eventsare reduced due to the pressure and temperature limitations of theseMODES. Thus, the Containment Spray and Containment Coolingsystems are not required to be OPERABLE in MODES 4, 5 and 6.



BASES

ACTIONS A.1

Condition A is applicable whenever one or more containment coolingtrains is inoperable. Action A.1 requires restoration of both trains toOPERABLE status within 72 hours. The 72-hour Completion Time forCondition A is based on the assumption that at least 100% of the requiredpost accident containment cooling capability (that assumed in the safetyanalyses) is available. If less than 100% of the required post containmentaccident cooling is available, Condition C must also be entered.

Mechanical system LCOs typically provide a 72 hour Completion Timeunder conditions when a required system can perform its required safetyfunction, but may not be able to do so assuming an additional failure.When operating in accordance with the Required Actions of an LCOCondition, it is not necessary to be able to cope with an additional singlefailure.

The Containment Cooling systems can provide one hundred percent ofthe required post accident cooling capability following the occurrence ofany single active failure. Therefore, the containment cooling function canbe met during conditions when those components which could bedeactivated by a single active failure are known to be inoperable. Underthat condition, however, the ability to provide the function after theoccurrence of an additional failure cannot be guaranteed. Therefore,continued operation with one or more trains inoperable is allowed only fora limited time.

B.1 and B.2

Condition B is applicable when the Required Actions of Condition Acannot be completed within the required Completion Time. Condition A isapplicable whenever one or more trains is inoperable. Therefore, whenCondition B is applicable, Condition A is also applicable. (If less than100% of the post accident containment cooling capability is available,Condition C must be entered as well.) Being in Conditions A and Bconcurrently maintains both Completion Time clocks for instances whereequipment repair allows exit from Condition B while the plant is still withinthe applicable conditions of the LCO.

If the inoperable containment cooling trains cannot be restored toOPERABLE status within the required Completion Time of Condition A,the plant must be brought to a MODE in which the LCO does not apply.To achieve this status, the plant must be brought to at least MODE 3within 6 hours and to MODE 4 within 30 hours. The allowed CompletionTimes are reasonable, based on operating experience, to reach therequired plant conditions from full power conditions in an orderly mannerand without challenging plant systems.



BASES

ACTIONS C.1(continued)

Condition C is applicable with one or more trains inoperable when there isless than 100% of the required post accident containment coolingcapability available. Condition A is applicable whenever one or moretrains is inoperable. Therefore, when this Condition is applicable,Condition A is also applicable. Being in Conditions A and C concurrentlymaintains both Completion Time clocks for instances where equipmentrepair restores 100% of the required post accident containment coolingcapability while the LCO is still applicable, allowing exit from Condition C(and LCO 3.0.3).

Several specific cases have been analyzed in the safety analysis toprovide operating flexibility for equipment outages and testing. Theseanalyses show that action A.1 can be entered under certaincircumstances, because 100% of the post accident cooling capability ismaintained. These specific cases are discussed below.

One hundred percent of the required post accident cooling capability canbe provided with both MSIV bypass valves closed if either;

1. Two containment spray pumps, and two spray headers areOPERABLE, or

2. One containment spray pump, two spray headers, and three safetyrelated CACs, are OPERABLE (at least two service water pumpsmust be OPERABLE if CACs are to be relied upon).

One hundred percent of the required post accident cooling capability canbe provided for operation with a MSIV bypass valve open or closed ifeither;

1. Two containment spray pumps, two spray headers, and two safetyrelated CACs, are OPERABLE (at least two service water pumpsmust be OPERABLE if CACs are to be relied upon), or

2. One containment spray pump, one spray header, and three safetyrelated CACs are OPERABLE (at least three service water pumpsmust be OPERABLE to provide the necessary service water flow toassure OPERABILITY of the CACs).

The components described in items 1 and 2 directly above, are necessaryto mitigate a MSLB where offsite power is available and primary coolantpumps continue to operate. Therefore, components from both trains ofcontainment heat removal are required.



BASES

ACTIONS C.1 (continued)

If the Containment Spray side (tube side) of SDC Heat Exchanger E-60Bis out of service, 100% of the required post accident cooling capabilitycan be provided, if other equipment outages are limited. One hundredpercent of the post accident cooling can be provided with theContainment Spray side of SDC Heat Exchanger E-60B out of service ifthe following equipment is OPERABLE: three safety related ContainmentAir Coolers, two Containment Spray Pumps, two spray headers, CCWpumps P-52A and P-52B, two SWS pumps, and both CCW HeatExchangers, and if

1. One CCW Containment Isolation Valve, CV-0910, CV-091 1, orCV-0940, is OPERABLE, and

2. Two CCW isolation valves for the non-safety related loads outsidethe containment, CV-0944A and CV-0944 (or CV-0977B), areOPERABLE.

With less than 100% of the required post accident containment coolingcapability available, the plant is in a condition outside the assumptions ofthe safety analyses. Therefore, LCO 3.0.3 must be entered immediately.


Verifying the correct alignment for manual, power operated, andautomatic valves, excluding check valves, in the Containment SpraySystem provides assurance that the proper flow path exists forContainment Spray System operation. This SR also does not apply tovalves that are locked, sealed, or otherwise secured in position sincethese were verified to be in the correct positions prior to being secured.This SR also does not apply to valves that cannot be inadvertentlymisaligned, such as check valves. This SR does not require any testingor valve manipulation. Rather, it involves verification that those valvesoutside containment and capable of potentially being mispositioned, arein the correct position.

SR 3.6.6.2

Operating each safety related Containment Air Cooler fan unit for_> 15 minutes ensures that all trains are OPERABLE and are functioningproperly. The 31-day Frequency was developed considering the knownreliability of the fan units, the two train redundancy available, and the lowprobability of a significant degradation of the containment cooling trainoccurring between surveillances.

Palisades Nuclear Plant B 3.6.6-10 Revised 03115/2012


BASES


(continued)

SR 3.6.6.3

Verifying the containment spray header is full of water to the 735 ftelevation minimizes the time required to fill the header. This ensures thatspray flow will be admitted to the containment atmosphere within the timeframe assumed in the containment analysis. The 31-day Frequency isbased on the static nature of the fill header and the low probability of asignificant degradation of the water level in the piping occurring betweensurveillances.

SR 3.6.6.4

Verifying a total service water flow rate of __ 4800 gpm to CACs VHX-1,VHX-2, and VHX-3, when aligned for accident conditions, providesassurance the design flow rate assumed in the safety analyses will beachieved (Ref. 8). Also considered in selecting this Frequency were theknown reliability of the cooling water system, the two train redundancy,and the low probability of a significant degradation of flow occurringbetween surveillances.

SR 3.6.6.5

Verifying that each containment spray pump's developed head at the flowtest point is greater than or equal to the required developed head ensuresthat spray pump performance has not degraded during the cycle. Flowand differential pressure are normal tests of centrifugal pumpperformance required by Section XI of the ASME Code (Ref. 5).

Since the containment spray pumps cannot be tested with flow throughthe spray headers, they are tested on recirculation flow. This testconfirms one point on the pump design curve and is indicative of overallperformance. Such inservice inspections confirm componentOPERABILITY, trend performance, and detect incipient failures byindicating abnormal performance. The Frequency of this SR is inaccordance with the Inservice Testing Program.



BASES


(continued)

SR 3.6.6.6 and SR 3.6.6.7

SR 3.6.6.6 verifies each automatic containment spray valve actuates toits correct position upon receipt of an actual or simulated actuation signal.This Surveillance is not required for valves that are locked, sealed, orotherwise secured in the required position under administrative controls.SR 3.6.6.7 verifies each containment spray pump starts automatically onan actual or simulated actuation signal. The 18-month Frequency isbased on the need to perform these Surveillances under the conditionsthat apply during a plant outage and the potential for an unplannedtransient if the Surveillances were performed with the reactor at power.

Operating experience has shown that these components usually pass theSurveillances when performed at the 18 month Frequency. Therefore,the Frequency was concluded to be acceptable from a reliabilitystandpoint.

Where the surveillance of containment sump isolation valves is alsorequired by SR 3.5.2.5, a single surveillance may be used to satisfy bothrequirements.

SR 3.6.6.8

This SR verifies each safety related containment cooling fan actuatesupon receipt of an actual or simulated actuation signal. The 18-monthFrequency is based on engineering judgement and has been shown to beacceptable through operating experience. See SR 3.6.6.6 and SR3.6.6.7, above, for further discussion of the basis for the 18 monthFrequency.

SR 3.6.6.9

With the containment spray inlet valves closed and the spray headerdrained of any solution, an inspection of spray nozzles, or a test thatblows low-pressure air or smoke through test connections can becompleted. Performance of this SR demonstrates that each spray nozzleis unobstructed and provides assurance that spray coverage of thecontainment during an accident is not degraded. Verification followingmaintenance which could result in nozzle blockage is appropriatebecause this is the only activity that could lead to nozzle blockage.



BASES



3. FSAR, Sections 6.2


5. ASME, Boiler and Pressure Vessel Code, Section Xl

6. FSAR, Table 14.18.1-3

7. FSAR, Table 14.18.2-1

8. FSAR, Table 9-1

9. EA-GOTHIC-04-09 Rev. 3, Containment Response to a MSLBUsing GOTHIC 7.2a, October 2010.

10. EA-GOTHIC-04-08, Rev. 3, Containment Response to a LOCAUsing GOTHIC 7.2a, October 2010.


Spent Fuel Pool StorageB 3.7.16

B 3.7 PLANT SYSTEMS

B 3.7.16 Spent Fuel Pool StorageBASES

BACKGROUND The fuel storage facility is designed to store either new (nonirradiated)nuclear fuel assemblies, or used (irradiated) fuel assemblies in avertical configuration underwater. The storage pool is sized to store892 fuel assemblies, which includes storage for failed fuel canisters.The fuel storage racks are grouped into two regions, Region I andRegion II per Figure B 3.7.16-1. The racks are designed as a SeismicCategory I structure able to withstand seismic events. Region Icontains racks in the spent fuel pool having a 10.25 inch center-to-center spacing and a single rack in the north tilt pit having an 11.25 inchby 10.69 inch center-to-center spacing. Region II contains racks in boththe spent fuel pool and the north tilt pit having a 9.17 inchcenter-to-center spacing. Region I has restrictive loading patterns toaddress degradation of neutron absorbing material in the Region Iracks. The loading patterns accommodate face-adjacent fuelassemblies with consideration of burnup credit in subregion 1 B, 1 C, 1 D,and 1 E. Region I also has provisions for storing non-fissile bearingcomponents. Because of the smaller spacing and an analyzed poisonconcentration of zero (Boraflex), Region II also has limitations for fuelstorage. Further information on limitations can be found in Section 4.0,"Design Features." These limitations (e.g., enrichment, burnup, loadingpatterns) are sufficient to maintain a keff of _< 0.95 when flooded withborated water and keff < 1.0 when flooded with unborated water.


The fuel storage facility was originally designed for noncriticality by useof adequate spacing, and "flux trap" construction, whereby the fuelassemblies are inserted into neutron absorbing stainless steel cans.The current criticality calculations also take credit for soluble boron toprevent criticality.

The spent fuel pool storage meets the requirements specified in"Guidance on the Regulatory Requirements for Criticality Analysis ofFuel Storage at Light-Water Reactor Power Plants", Laurence I. Kopp,U.S. Nuclear Regulatory Commission, Office of Nuclear ReactorRegulation, Reactor Systems Branch, February 1998. This documentestablished the requirements for use of soluble boron to maintainkeff •0.95.

The spent fuel pool storage satisfies Criterion 2 of 10 CFR 50.36(c)(2).

Palisades Nuclear Plant B 3.7.16-1 Amendment No. 489, 207, 2-96, 246Revised 11/08/2012


BASES

LCO The restrictions for Region I in Specification 4.3.1.1 on fuel assemblymaximum nominal planar average U-235 enrichment and minimumburnup along with their storage pool loading patterns plus therestrictions on the placement of non-fissile bearing components, ensurethat the keff of the spent fuel pool will always remain _< 0.95, assumingthe pool to be flooded with water borated to 850 ppm. Non-fissilebearing components shall be stored in accordance with Specification4.3.1.1 m. Specification 4.3.1.1 refers to Tables 3.7.16-2 through3.7.16-5 in the accompanying LCO.

The restrictions for Region II in Table 3.7.16-1, in the accompanyingLCO, on fuel assembly decay time, maximum nominal planar averageU-235 enrichment and minimum burnup combinations, ensure that thekeff of the spent fuel pool will always remain _< 0.95, assuming the poolto be flooded with water borated to 850 ppm. The restrictions areconsistent with the criticality safety analyses performed for the spentfuel pool according to Table 3.7.16-1, in the accompanying LCO. Fuelassemblies not meeting the criteria of Table 3.7.16-1 shall be stored inaccordance with Specification 4.3.1.1.

Specification 4.3.1.1, 4.3.1.2, and 4.3.1.3 describe U-235 enrichmentrestrictions for fuel assemblies stored based on maximum nominalplanar average U-235 enrichment. The term "nominal" describes thedesign enrichment specified for an assembly. The criticality calculationsthat support the storage requirements include a manufacturer's fuelenrichment tolerance of ±0.05 weight percent U-235. Specifications4.3.1.1, 4.3.1.2, or 4.3.1.3 do not include the manufacturer's fuelenrichment tolerance.

The term "maximum" refers to an assembly's limiting nominal planaraverage U-235 enrichment. Palisades' fuel assembly design may haveseveral distinct axial planar regions, and each region may have adifferent nominal planar average U-235 enrichment. Additionally, fuelassembly enrichments may vary from pin to pin within a given axialplanar region. The criticality analysis conservatively assumes each pinis loaded with the nominal enrichment for that planar region. Thehighest nominal planar average enrichment of the distinct axial planarregions is considered to be the maximum nominal planar averageenrichment for that assembly. This value is used to verify that storagerequirements have been met. The manufacturer's fuel enrichmenttolerance of ±0.05 weight percent is excluded from this value.

Sub-Regions 1A, 1B, & 1C, in Region 1 of the main fuel pool can bedistributed in any manner providing that any 2-by-2 grouping of cells

Palisades Nuclear Plant B 3.7.16-2 Amendment No. 489, 207, 236, 246Revised 11/08/2012


BASES

and the assemblies in them meet the requirements of 4.3.1.lf, 4.3.1.lg,or 4.3.1.1h for the number of cells occupied. For example, for a 4-by-4group of cells, all of the following 2-by-2 configurations must beexamined against the above requirements:

The concept in the example above shall be expanded for the entireRegion I of the main fuel pool.

Similarly, Sub-Regions 1 D & 1 E, in Region 1 of the north tilt pit can bedistributed in any manner providing that any 2-by-2 grouping of cellsand the assemblies in them meet the requirements of 4.3.1.lj or4.3.1.1 k for the number of cells occupied.

APPLICABILITY This LCO applies whenever any fuel assembly or non-fissile bearingcomponent is stored in the spent fuel pool or the north tilt pit.

ACTIONS The ACTIONS are modified by a Note indicating that LCO 3.0.3 does notapply.

If moving irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3would not specify any action. If moving irradiated fuel assemblies while inMODE 1, 2, 3, or 4, the fuel movement is independent of reactoroperation. Therefore, in either case, inability to move fuel assemblies isnot sufficient reason to require a reactor shutdown.

When the configuration of fuel assemblies or non-fissile bearing

Palisades Nuclear Plant B 3.7.16-3 Amendment No. 4-89, 2-0-7, 2-W, 246Revised 11/08/2012


BASES

components stored in the spent fuel pool is not in accordance with thestorage requirements, immediate action must be taken to make thenecessary movement(s) to bring the configuration into compliance withthe requirements.


SR 3.7.16.1

This SR verifies by administrative means that the combination of fuelassembly maximum nominal planar average enrichment and proposedfuel assembly placement is in accordance with Specification 4.3.1.1 priorto placing the assembly in a storage location. This SR also verifies byadministrative means that non-fissile bearing component storage will bein accordance with Specification 4.3.1.lm prior to placing the componentin a Region I storage location.

This SR also verifies by administrative means that the combination ofmaximum nominal planar average U-235 enrichment, burnup and decaytime of the fuel assembly is in accordance with Table 3.7.16-1, 3.7.16-2,3.7.16-3, 3.7.16-4 or 3.7.16-5, as appropriate, in the accompanying LCOprior to placing the fuel assembly in a storage location.

REFERENCES None

Palisades Nuclear Plant B 3.7.16-4 Amendment No. 489, 2--7, 236, 246Revised 11/08/2012


BASES

N _ ý

176.00"

Ref.

MAIN POOL

Region I of the main pool iscomprised of Sub-Regions1A, 1B, and 1C. Region I ofthe north tilt pit is comprisedof Sub-Regions 1D and 1E.These Sub-Regions aredefined in Specification4.3.1.1 and are not relatedto the rack.

Figure B 3.7.16-1 (page 1 of 1)Spent Fuel Pool Arrangement

Palisades Nuclear Plant B 3.7.16-5 Amendment No. 41-9, 2-W, 2a6, 246Revised 11/08/2012

AC Sources - OperatingB 3.8.1

3.8 ELECTRICAL POWER SYSTEMS

B 3.8.1 AC Sources - Operating

BASES

BACKGROUND Sources of AC power to the plant Class 1E Electrical Power DistributionSystem include the offsite power sources, and the Class 1 E onsitestandby power sources, Diesel Generators 1-1 and 1-2 (DGs). Asrequired by 10 CFR 50, Appendix A, GDC 17 (Ref. 1), the design of theAC electrical power system provides independence and redundancy toensure an available source of power to the Engineered Safety Feature(ESF) systems.

The AC power system at Palisades consists of a 345 kV switchyard,three circuits connecting the plant with off-site power (station power,startup, and safeguards transformers), the on-site distribution system,and two DGs. The on-site distribution system is divided into safetyrelated (Class 1 E) and non-safety related portions.

The switchyard interconnects six transmission lines from the off-sitetransmission system, the output line from the Covert GeneratingStation, and the output line from the Palisades main generator. Theselines are connected in a "breaker and a half scheme between theFront (F) and Rear (R) buses such that any single off-site line maysupply the Palisades station loads when the plant is shutdown.

Two circuits supplying Palisades 2400 V buses from off-site are feddirectly from a switchyard bus through the startup and safeguardstransformers. They are available both during operation and duringshutdown. The third circuit supplies the plant loads by "back feeding"through the main generator output circuit and station powertransformers after the generator has been disconnected by a motoroperated disconnect.

The station power transformers are connected into the main generatoroutput circuit. Station power transformers 1-1 and 1-2 connect to thegenerator 22 kV output bus. Station power transformer 1-3 connects tothe generator output line on the high voltage side of the maintransformer. Station power transformers 1-1 and 1-3 supply non-safetyrelated 4160 V loads during plant power operation and duringbackfeeding operations. Station power transformer 1-2 can supply bothsafety related and non-safety related 2400 V loads during backfeedingoperation.

Palisades Nuclear Plant B 3.8.1-1 Revised 11/08/2012Palisades Nuclear Plant B 3.8.1 -1 Revised 11/08/2012


BASES

BACKGROUND The three startup transformers are connected to a common 345 kV(continued) overhead line from the switchyard R bus. Startup transformers 1-1 and

1-3 supply 4160 V non-safety related station loads; Startup Transformer1-2 can supply both safety related and non-safety related 2400 V loads.The startup transformers are available during operation and shutdown.

Safeguards Transformer 1-1 is connected to the switchyard F bus. Itfeeds station 2400 V loads through an underground line. It is availableto supply these loads during operation and shutdown.

The onsite distribution system consists of seven main distribution buses(4160 V buses 1A, 1B, 1F, and 1G, and 2,400 V buses 1C, 1D, and 1E)and supported lower voltage buses, Motor Control Centers (MCCs), andlighting panels. The 4160 V buses and 2400 V bus 1E are not safetyrelated. Buses 1 C and 1D and their supported buses and MCCs formtwo independent, redundant, safety related distribution trains. Eachdistribution train supplies one train of engineered safety featuresequipment.

In the event of a generator trip, all loads supplied by the station powertransformers are automatically transferred to the startup transformers.Loads supplied by the safeguards transformer are unaffected by a planttrip. If power is lost to the safeguards transformer, the 2400 V loads willautomatically transfer to startup transformer 1-2. If the startuptransformers are not energized when these transfers occur, their outputbreakers will be blocked from closing and the 2400 V safety relatedbuses will be energized by the DGs.

The two DGs each supply one 2400 V bus. They provide backup powerin the event of loss of off-site power, or loss of power to the associated2400 V bus. The continuous rating of the DGs is 2500 kW, with110 percent overload permissible for 2 hours. The required fuel in theFuel Oil Storage Tank and DG Day Tank will supply one DG for aminimum period of 7 days assuming accident loading conditions.

If either 2400 V bus, 1 C or 1 D, experiences a sustained undervoltage,the associated DG is started, the affected bus is separated from itsoffsite power sources, major loads are stripped from that bus and itssupported buses, the DGs are connected to the bus, and ECCS orshutdown loads are started by an automatic load sequencer.



BASES


The DGs share a common fuel oil storage and transfer system. Asingle buried Fuel Oil Storage Tank is used, along with an individual daytank for each DG, to maintain the required fuel oil inventory. Two fueltransfer pumps are provided. The fuel transfer pumps are necessary forlong-term operation of the DGs. Testing and analysis have shown thateach DG consumes about 200 gallons of fuel oil per hour at 2750 kWand about 180 gallons of fuel oil per hour at 2500 kW. Each day tank isrequired to contain at least 2500 gallons and contains sufficient fuel forabout 13.5 hours of full load operation (Ref. 8). Beyond that time, a fueltransfer pump is required for continued DG operation.

Either fuel transfer pump is capable of supplying either DG. However,each fuel transfer pump is not capable, with normally availableswitching, of being powered from either DG. DG 1-1 can power eitherfuel transfer pump, but DG 1-2 can only power P-18A. The fuel oilpumps share a common fuel oil storage tank, and common piping.

Fuel transfer pump P-18A is powered from MCC-8, which is normallyconnected to Bus 1D (DG 1-2) through Station Power Transformer 12and Load Center 12. In an emergency, P-1 8A can be powered fromBus 1 C (DG 1-1) by cross-connecting Load Centers 11 and 12.

Fuel transfer pump P-18B is powered from MCC-1, which is normallyconnected to Bus 1C (DG 1-1) through Station Power Transformer 19and Load Center 19. P-18B cannot be powered, using installedequipment, from Bus 1D (DG 1-2).


The safety analyses do not explicitly address AC electrical power. Theydo, however, assume that the Engineered Safety Features (ESF) areavailable. The OPERABILITY of the ESF functions is supported by theAC Power Sources.

The design requirements are for each assumed safety function to beavailable under the following conditions:

a. The occurrence of an accident or transient,

b. The resultant consequential failures,

c. A worst-case single active failure,

d. Loss of all offsite or all onsite AC power, and

e. The most reactive control rod fails to insert.



BASES

APPLICABLE One proposed mechanism for the loss of off-site power is a perturbationSAFETY ANALYSES of the transmission grid because of the loss of the plant's generating

(continued) capacity. A loss of off-site power as a result of a generator trip can onlyoccur during MODE 1 with the generator connected to the grid.However, it is also assumed in analysis for some events in MODE 2,such as a control rod ejection. No specific mechanism for initiating aloss of off-site power when the plant is not on the line is discussed inthe FSAR.

In most cases, it is conservative to assume that off-site power is lostconcurrent with the accident and that the single failure is that of a DG.That would leave only one train of safeguards equipment to cope withthe accident, the other being disabled by the loss of AC power. Thoseanalyses which assume that a loss of off-site power and failure of asingle DG accompany the accident assume 11 seconds from the loss ofpower until the bus is re-energized. This time includes time for allportions of the circuitry necessary for detecting the undervoltage (relaysand auxiliary relays) and starting the DG. Included in the 11 seconds,the analyses also assume 10 seconds for the DG to start and connectto the bus, and additional time for the sequencer to start eachsafeguards load.

The same assumptions are not conservative for all accident analyses.When analyzing the effects of a steam or feed line break, the loss of thecondensate and feedwater pumps would reduce the steam generatorinventory, so a loss of off-site power is not assumed.

In MODE 5 and MODE 6, loss of off-site power can be considered as aninitiating event for a loss of shutdown cooling event.

The AC sources satisfy Criterion 3 of 10 CFR 50.36(c)(2).

LCO Two qualified circuits between the offsite transmission network and theonsite Class 1 E Electrical Power Distribution System and anindependent DG for each safeguards train ensure availability of therequired power to shut down the reactor and maintain it in a safeshutdown condition after an anticipated operational occurrence or apostulated DBA.



BASES

LCO(continued)

General Design Criterion 17 (Ref. 1) requires, in part, that: "Electricpower from the transmission network to the'onsite electric distributionsystem shall be supplied by two physically independent circuits (notnecessarily on separate rights of way) designed and located so as tominimize to the extent practical the likelihood of their simultaneousfailure under operating and postulated accident and environmentalconditions."

The qualified offsite circuits available are Safeguards Transformer 1-1and Startup Transformer 1-2. Station Power Transformer 1-2 is notqualified as a required source for LCO 3.8.1 since it is not independentof the other two offsite circuits. Station Power Transformer 1-2 will notbe used in normal operations to power the 2400 V safety related busesin Modes 1-4.

Each offsite circuit must be capable of maintaining acceptablefrequency and voltage, and accepting required loads during anaccident, while supplying the 2400 V safety related buses.

Following a loss of offsite power, each DG must be capable of startingand connecting to its respective 2400 V bus. This will be accomplishedwithin 10 seconds after receipt of a DG start signal. Each DG must alsobe capable of accepting required loads within the assumed loadingsequence intervals, and continue to operate until offsite power can berestored to the 2400 V safety related buses.

Proper sequencing of loads and tripping of nonessential loads arerequired functions for DG OPERABILITY.

APPLICABILITY The AC sources are required to be OPERABLE above MODE 5 toensure that redundant sources of off-site and on-site AC power areavailable to support engineered safeguards equipment in the event ofan accident or transient. The AC sources also support the equipmentnecessary for power operation, plant heatups and cooldowns, andshutdown operation.

The AC source requirements for MODES 5 and 6, and duringmovement of irradiated fuel assemblies are addressed in LCO 3.8.2,"AC Sources - Shutdown."



BASES

ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable DG.There is an increased risk associated with entering a MODE or otherspecified condition in the Applicability with an inoperable DG and theprovisions of LCO 3.0.4.b, which allow entry into a MODE or otherspecified condition in the Applicability with the LCO not met afterperformance of a risk assessment addressing inoperable systems andcomponents, should not be applied in this circumstance.

A.1

To ensure a highly reliable power source remains with the one offsitecircuit inoperable, it is necessary to verify the OPERABILITY of theremaining required offsite circuit on a more frequent basis. Since theRequired Action only specifies "perform," a failure of SR 3.8.1.1acceptance criteria does not result in failure to meet this RequiredAction. However, if a second required circuit fails SR 3.8.1.1, thesecond offsite circuit is inoperable, and Condition C, for two offsitecircuits inoperable, is entered.

As stated in SR 3.0.2, the 25% extension allowed by SR 3.0.2 may beapplied to Required Actions whose Completion Time is stated as "onceper.. ." however, the 25% extension does not apply to the initialperformance of a Required Action with a periodic Completion Time thatrequires performance on a "once per.. ." basis. The 25% extensionapplies to each performance of the Required Action after the initialperformance. Therefore, while Required Action 3.8.1 A.1 must beinitially performed within 1 hour without any SR 3.0.2 extension,subsequent performances at the "Once per 8 hours" interval may utilizethe 25% SR 3.0.2 extension.

A.2

According to the recommendations of Regulatory Guide (RG) 1.93(Ref. 2), operation may continue in Condition A for a period that shouldnot exceed 72 hours. With one offsite circuit inoperable, the reliability ofthe offsite system is degraded, and the potential for a loss of offsitepower is increased, with attendant potential for a challenge to the plantsafety systems. In this Condition, however, the remaining OPERABLEoffsite circuit and DGs are adequate to supply electrical power to theonsite Class 1E Distribution System.



BASES

ACTIONS A.2 (continued)

The 72-hour Completion Time takes into account the capacity andcapability of the remaining AC sources, a reasonable time for repairs,and the low probability of a DBA occurring during this period. Thesecond Completion Time for Required Action A.2 establishes a limit onthe maximum time allowed for any combination of required AC powersources to be inoperable during any single continuous occurrence offailing to meet the LCO. If Condition A is entered while, for instance, aDG is inoperable, and that DG is subsequently returned OPERABLE,the LCO may already have been not met for up to 7 days. This couldlead to a total of 10 days, since initial failure to meet the LCO, to restorethe offsite circuit. At this time, a DG could again become inoperable,the circuit restored OPERABLE, and an additional 7 days (for a total of17 days) allowed prior to complete restoration of the LCO. The 10-dayCompletion Time provides a limit on the time allowed in a specifiedcondition after discovery of failure to meet the LCO. This limit isconsidered reasonable for situations in which Conditions A and B areentered concurrently. The "AND" connector between the 72 hour and10 day Completion Time means that both Completion Times applysimultaneously, and the more restrictive Completion Time must be met.

The Completion Time allows for an exception to the normal "time zero"for beginning the Completion Time "clock." This will result inestablishing the "time zero" at the time that the LCO was initially notmet, instead of at the time Condition A was entered.

B.1

To ensure a highly reliable power source remains with an inoperableDG, it is necessary to verify the availability of the offsite circuits on amore frequent basis. Since the Required Action only specifies"perform," a failure of SR 3.8.1.1 acceptance criteria does not result in aRequired Action being not met. However, if a circuit fails to passSR 3.8.1.1, it is inoperable. Upon offsite circuit inoperability, additionalConditions and Required Actions must then be entered.



BASES


In accordance with LCO 3.0.6, the requirement to declare requiredfeatures inoperable carries with it the requirement to take those actionsrequired by the LCO for that required equipment.

Required Action B.2 is intended to provide assurance that a loss ofoffsite power, during the period that a DG is inoperable, does not resultin a complete loss of safety function of critical systems. These featuresare designed with redundant safety related trains. Redundant requiredfeature failures consist of inoperable features within a train redundant tothe train that has an inoperable DG. If the train that has an inoperableDG contains multiple features redundant to the inoperable feature in theother train, all those multiple features must be declared inoperable. Forexample, if DG 1-1 and Containment Spray Pump P-54A are inoperableconcurrently, Containment Spray Pumps P-54B and P-54C must bothbe declared inoperable. In this example, if off-site power were lost,neither P-54B nor P-54C would be available.

The Completion Time for Required Action B.2 is intended to allow theoperator time to evaluate and repair any discovered inoperabilities.This Completion Time also allows for an exception to the normal "timezero" for beginning the Completion Time "clock." In this RequiredAction, the Completion Time only begins on discovery that both:

a. An inoperable DG exists; and

b. A required feature on the other train is inoperable.

If at any time during the existence of this Condition (one DG inoperable)a redundant required feature subsequently becomes inoperable, thisCompletion Time begins to be tracked.

Discovering one required DG inoperable coincident with one or moreinoperable required supporting or supported features, or both, that areassociated with the OPERABLE DG, results in starting the CompletionTime for Required Action B.2. Four hours from the discovery of theseevents existing concurrently, is acceptable because it minimizes riskwhile allowing time for restoration before subjecting the plant totransients associated with shutdown.

In this Condition, the remaining OPERABLE DG and offsite circuits areadequate to supply electrical power to the onsite Class 1 E DistributionSystem. Thus, on a component basis, single failure protection for therequired feature's function may have been lost; however, function hasnot been lost.



BASES

ACTIONS B.2 (continued)

The 4-hour Completion Time takes into account the OPERABILITY ofthe redundant counterpart to the inoperable required feature.Additionally, the 4-hour Completion Time takes into account thecapacity and capability of the remaining AC sources, a reasonable timefor repairs, and the low probability of a DBA occurring during this period.

B.3.1 and B.3.2

Required Action B.3 provides an allowance to avoid unnecessarytesting of the OPERABLE DG. If it can be determined that the cause ofthe inoperable DG does not exist on the OPERABLE DG, SR 3.8.1.2(test starting of the OPERABLE DG) does not have to be performed. Ifthe cause of inoperability exists on other rGs, the other DGs would bedeclared inoperable upon discovery and Condition E of LCO 3.8.1would be entered. Once the failure is repaired, the common causefailure no longer exists and Required Action B.3.1 is satisfied. If thecause of the initial inoperable DG cannot be confirmed to not exist onthe remaining DG, performance of SR 3.8.1.2 suffices to provideassurance of continued OPERABILITY of that DG.

In the event the inoperable DG is restored to OPERABLE status prior tocompleting Required Action B.3.1 or B.3.2 the corrective action systemwould normally continue to evaluate the common cause possibility.This continued evaluation, however, is no longer under the 24-hourconstraint imposed while in Condition B. According to GenericLetter 84-15 (Ref. 3), 24 hours is reasonable to confirm that theOPERABLE DG is not affected by the same problem as the inoperableDG.

Palisades Nuclear Plant B 3.8.1-9 Revised 11/08/2012Palisades Nuclear Plant B 3.8.1 -9 Revised 11/08/2012


BASES


In Condition B, the remaining OPERABLE DG and offsite circuits areadequate to supply electrical power to the onsite Class 1 E DistributionSystem for a limited period. The 7-day Completion Time takes intoaccount the capacity and capability of the remaining AC sources, areasonable time for repairs, and the low probability of a DBA occurringduring this period.

The second Completion Time for Required Action B.4 establishes a limiton the maximum time allowed for any combination of required ACpower sources to be inoperable during any single contiguousoccurrence of failing to meet the LCO. If Condition B is entered while,for instance, an offsite circuit is inoperable and that circuit issubsequently returned OPERABLE, the LCO may already have beennot met for up to 72 hours. This could lead to a total of 10 days, sinceinitial failure to meet the LCO, to restore the DG. At this time, an offsitecircuit could again become inoperable, the DG restored OPERABLE,and an additional 72 hours (for a total of 13 days) allowed prior tocomplete restoration of the LCO. The 10-day Completion Timeprovides a limit on time allowed in a specified condition after discoveryof failure to meet the LCO. This limit is considered reasonable forsituations in which Conditions A and B are entered concurrently. The"AND" connector between the 7 day and 10 day Completion Timemeans that both Completion Times apply simultaneously, and the morerestrictive Completion Time must be met.

As in Required Action B.2, the Completion Time allows for an exceptionto the normal "time zero" for beginning the allowed time "clock." Thiswill result in establishing the "time zero" at the time that the LCO wasinitially not met, instead of at the time Condition B was entered.



BASES


In accordance with LCO 3.0.6 the requirement to declare requiredfeatures inoperable carries with it the requirement to take those actionsrequired by the LCO for that required equipment.

Required Action C.1, which applies when two required offsite circuitsare inoperable, is intended to provide assurance that an event with acoincident single failure will not result in a complete loss of redundantrequired safety functions. The Completion Time for this failure ofredundant required features is reduced to 12 hours. The rationale forthe reduction to 12 hours is that RG 1.93 (Ref. 2) recommends aCompletion Time of 24 hours for two required offsite circuits inoperable,based upon the assumption that two complete safety trains areOPERABLE. When a concurrent redundant required feature failureexists, this assumption is not the case, and a shorter Completion Timeof 12 hours is appropriate. These features are powered from redundantAC safety trains.

The Completion Time for Required Action C.1 is intended to allow theoperator time to evaluate and repair any discovered inoperabilities.This Completion Time also allows for an exception to the normal "timezero" for beginning the Completion Time "clock." In this RequiredAction, the Completion Time only begins on discovery that both:

a. All required offsite circuits are inoperable; and

b. A required feature is inoperable.

If at any time during the existence of Condition C (two offsite circuitsinoperable), a required feature becomes inoperable, this CompletionTime begins to be tracked.



BASES


According to the recommendations of RG 1.93 (Ref. 2), operation maycontinue in Condition C for a period that should not exceed 24 hours.This level of degradation means that the offsite electrical power systemdoes not have the capability to accomplish a safe shutdown and tomitigate the effects of an accident; however, the onsite AC sourceshave not been degraded. This level of degradation generallycorresponds to a total loss of the immediately accessible offsite powersources.

With both of the required offsite circuits inoperable, sufficient onsite ACsources are available to maintain the plant in a safe shutdown conditionin the event of a DBA or transient. In fact, a simultaneous loss of offsiteAC sources, a LOCA, and a worst-case single failure were postulatedas a part of the design basis in the safety analysis. Thus, the 24 hourCompletion Time provides a period of time to effect restoration of one ofthe offsite circuits commensurate with the importance of maintaining anAC electrical power system capable of meeting its design criteria.

If two offsite sources are restored within 24 hours, unrestrictedoperation may continue. If only one offsite source is restored within24 hours, power operation continues in accordance with Condition A.

D.1 and D.2

Pursuant to LCO 3.0.6, the Distribution System ACTIONS would not beentered even if all AC sources to it were inoperable resulting inde-energization. Therefore, the Required Actions of Condition D aremodified by a Note to indicate that when Condition D is entered with noAC source to any train, the Conditions and Required Actions forLCO 3.8.9, "Distribution Systems - Operating," must be immediatelyentered. This allows Condition D to provide the requirements for theloss of one offsite circuit and one DG without regard to whether a trainis de-energized. LCO 3.8.9 provides the appropriate restrictions for ade-energized train.

In Condition D, individual redundancy is lost in both the offsite electricalpower system and the onsite AC electrical power system. The 12-hourCompletion Time takes into account the capacity and capability of theremaining AC sources, a reasonable time for repairs, and the lowprobability of a DBA occurring during this period.

According to the recommendations of RG 1.93 (Ref. 2), operation maycontinue in Condition D for a period that should not exceed 12 hours.



BASES

ACTIONS E.1(continued)

With both DGs inoperable, there are no remaining standby AC sources.Thus, with an assumed loss of offsite electrical power, no AC sourcewould be available to power the minimum required ESF functions.Since the offsite electrical power system is the only source of AC powerfor this level of degradation, the risk associated with continuedoperation for a short time could be less than that associated with animmediate controlled shutdown (the immediate shutdown could causegrid instability, which could result in a total loss of AC power). Since aninadvertent generator trip could also result in a total loss of offsite ACpower, however, the time allowed for continued operation is severelyrestricted. The intent here is to avoid the risk associated with animmediate controlled shutdown and to minimize the risk associated withthis level of degradation.

According to the recommendations of RG 1.93 (Ref. 2), with both DGsinoperable, operation may continue for a period that should not exceed2 hours.

F.1 and F.2

If the inoperable AC power sources cannot be restored to OPERABLEstatus within the required Completion Time, the plant must be broughtto an operating condition in which the LCO does not apply. To achievethis status, the plant must be brought to at least MODE 3 within 6 hoursand to MODE 5 within 36 hours. The allowed Completion Times arereasonable, based on operating experience, to reach the required plantconditions from full power conditions in an orderly manner and withoutchallenging plant systems.

G.1

Condition G corresponds to a level of degradation in which allredundancy in the AC electrical power supplies has been lost. At thisseverely degraded level, any further losses in the AC electrical powersystem will cause a loss of function. Therefore, no additional time isjustified for continued operation. The unit is required by LCO 3.0.3 tocommence a controlled shutdown.



BASES

SURVEILLANCE The AC sources are designed to permit inspection and testing of allREQUIREMENTS important areas and features, especially those that have a standby

function, in accordance with 10 CFR 50, Appendix A, GDC 18 (Ref. 4).Periodic component tests are supplemented by extensive functionaltests during refueling outages (under simulated accident conditions).The SRs for demonstrating the OPERABILITY of the DGs are inaccordance with the recommendations of RG 1.9 (Ref. 5) and RG 1.137(Ref. 6).

Where the SRs discussed herein specify voltage and frequencytolerances for the DGs operated in the "Unit" mode, the following isapplicable. The minimum steady state output voltage of 2280 V is 95%of the nominal 2400 V generator rating. This value is above the settingof the primary undervoltage relays (127-1 and 127-2) and above theminimum analyzed acceptable bus voltage. It also allows for voltagedrops to motors and other equipment down through the 120 V level.The specified maximum steady state output voltage of 2520 V is 105%of the nominal generator rating of 2400 V. It is below the maximumvoltage rating of the safeguards motors, 2530 V. -The specifiedminimum and maximum frequencies of the DG are 59.5 Hz and61.2 Hz, respectively. The minimum value assures that ESF pumpsprovide sufficient flow to meet the accident analyses. The maximumvalue is equal to 102% of the 60 Hz nominal frequency and is derivedfrom the recommendations given in RG 1.9 (Ref. 5).

Higher maximum tolerances are specified for final steady state voltageand frequency following a loss of load test, because that test must beperformed with the DG controls in the "Parallel" mode. Since "Parallel"mode operation introduces both voltage and speed droop, the DG finalconditions will not return to the nominal "Unit" mode settings.

SR 3.8.1.1

This SR assures that the required offsite circuits are OPERABLE. Eachoffsite circuit must be energized from associated switchyard busthrough its disconnect switch to be OPERABLE.

Since each required offsite circuit transformer has only one possiblesource of power, the associated switchyard bus, and since loss ofvoltage to either the switchyard bus or the transformer is alarmed in thecontrol room, correct alignment and voltage may be verified by theabsence of these alarms.



BASES

SURVEILLANCE SR 3.8.1.1 (continued)REQUIREMENTS

The 7 day Frequency is adequate because disconnect switch positionscannot change without operator action and because their status isdisplayed in the control room.

SR 3.8.1.2

This SR helps to ensure the availability of the standby electrical powersupply to mitigate DBAs and transients and to maintain the plant in asafe shutdown condition.

The monthly test starting of the DG provides assurance that the DGwould start and be ready for loading in the time period assumed in thesafety analyses. The monthly test, however does not, and is notintended to, test all portions of the circuitry necessary for automaticstarting and loading. The operation of the bus undervoltage relays andtheir auxiliary relays which initiate DG starting, the control relay, whichinitiates DG breaker closure, and the DG breaker closure itself are notverified by this test. Verification of automatic operation of thesecomponents requires de-energizing the associated 2400 V bus andcannot be done during plant operation. For this test, the 10-secondtiming is started when the DG receives a start signal, and ends whenthe DG voltage sensing relays actuate. For the purposes of SR 3.8.1.2,the DGs are manually started from standby conditions. Standbyconditions for a DG mean the diesel engine is not running, its coolantand oil temperatures are being maintained consistent with manufacturerrecommendations, and > 20 minutes have elapsed since the last DG airroll.

Three relays sense the terminal voltage on each DG. These relays, inconjunction with a load shedding relay actuated by bus undervoltage,initiate automatic closing of the DG breaker. During monthly testing, theactuation of the three voltage sensing relays is used as the timing pointto determine when the DG is ready for loading.

The 31-day Frequency for performance of SR 3.8.1.2 agrees with theoriginal licensing basis for the Palisades plant.



BASES

SURVEILLANCE SR 3.8.1.3REQUIREMENTS(continued) This Surveillance verifies that the DGs are capable of synchronizing

with the offsite electrical system and accepting loads greater than orequal to the equivalent of the maximum expected accident loads for atleast 15 minutes. A minimum total run time of 60 minutes is required tostabilize engine temperatures.

During the period when the DG is paralleled to the grid, it must beconsidered inoperable. This is because there are no provisions toautomatically shift the DG controls from parallel mode to unit mode.Additionally, when paralleled, there are certain conditions where theprotection schemes may not prevent DG overloading and subsequentbreaker trip and lockout.

The 31-day Frequency for this Surveillance is consistent with theoriginal Palisades licensing basis.

The SR is modified by three Notes. Note 1 states that momentarytransients outside the required band do not invalidate this test. This isto assure that a minor change in grid conditions and the resultantchange in DG load, or a similar event, does not result in a surveillancebeing unnecessarily repeated. Note 2 indicates that this Surveillanceshould be conducted on only one DG at a time in order to avoidcommon cause failures that might result from offsite circuit or gridperturbations. Note 3 stipulates a prerequisite requirement forperformance of this SR. A successful DG start must precede this test tocredit satisfactory performance.

SR 3.8.1.4

This SR provides verification that the level of fuel oil in the day tank is ator above the level at which fuel oil is automatically added. Thespecified level is adequate for a minimum of 13.5 hours of DG operationat full load.

The 31-day Frequency is adequate to assure that a sufficient supply offuel oil is available, since low-level alarms are provided and plantoperators would be aware of any uses of the DG during this period.



BASES

SURVEILLANCE SR 3.8.1.5REQUIREMENTS(continued) Each DG is provided with an engine overspeed trip to prevent damage

to the engine. The loss of a large load could cause diesel engineoverspeed, which, if excessive, might result in a trip of the engine. ThisSurveillance demonstrates the DG load response characteristics andcapability to reject the largest single load without exceedingpredetermined voltage and frequency and while maintaining a specifiedmargin to the overspeed trip. This Surveillance may be accomplishedwith the DG in the "Parallel" mode.

An acceptable method is to parallel the DG with the grid and load theDG to a load equal to or greater than its single largest post-accidentload. The DG breaker is tripped while its voltage and frequency (orspeed) are being recorded. The time, voltage, and frequencytolerances specified in this SR are derived from the recommendationsof RG 1.9, Revision 3 (Ref. 5).

RG 1.9 (Ref. 5) recommends that the increase in diesel speed duringthe transient does not exceed 75% of the differencebetween synchronous speed and the overspeed trip setpoint, or15% above synchronous speed, whichever is lower. The PalisadesDGs have a synchronous speed of 900 rpm and an overspeed tripsetting range of 1060 to 1105 rpm. Therefore, the maximum acceptabletransient frequency for this SR is 68 Hz.

The minimum steady state voltage is specified to provide adequatemargin for the switchgear and for both the 2400 and 480 V safeguardsmotors; the maximum steady state voltage is 2400 +10% V asrecommended by RG 1.9 (Ref. 5).

The minimum acceptable frequency is specified to assure that thesafeguards pumps powered from the DG would supply adequate flow tomeet the safety analyses. The maximum acceptable steady statefrequency is slightly higher than the +2% (61.2 Hz) recommended byRG 1.9 (Ref. 5) because the test must be performed with the DGcontrols in the Parallel mode. The increased frequency allowance of0.3 Hz is based on the expected speed differential associated withperformance of the test while in the "Parallel" mode.

The 18-month surveillance Frequency is consistent with therecommendation of RG 1.9 (Ref. 5).



BASES


SR 3.8.1.6

This Surveillance demonstrates the DG capability to reject a full loadwithout overspeed tripping or exceeding the predetermined voltagelimits. The DG full load rejection may occur because of a system faultor inadvertent breaker tripping. This Surveillance ensures properengine and generator load response under a complete loss of load.These acceptance criteria provide DG damage protection. The 4000 Vlimitation is based on generator rating of 2400/4160V and the ratings ofthose components (connecting cables and switchgear) that wouldexperience the voltage transient. While the DG is not expected toexperience this transient during an event and continue to be available,this response ensures that the DG is not degraded for futureapplication, including re-connection to the bus if the trip initiator can becorrected or isolated.

In order to ensure that the DG is tested under load conditions that areas close to design basis conditions as possible, yet still provideadequate testing margin between the specified power factor limit andthe DG design power factor limit of 0.8, testing must be performed usinga power factor < 0.9. This is consistent with RG 1.9 (Ref. 5).

The 18-month Frequency is consistent with the recommendation ofRG 1.9 (Ref. 5) and is intended to be consistent with expected fuelcycle lengths.

SR 3.8.1.7

As recommended by RG 1.9 (Ref. 5) this Surveillance demonstrates theas designed operation of the standby power sources during loss of theoffsite source. This test verifies all actions encountered from the loss ofoffsite power, including shedding of the nonessential loads andre-energizing of the emergency buses and respective loads from theDG.

The requirement to energize permanently connected loads is met whenthe DG breaker closes, energizing its associated 2400 V bus.Permanently connected loads are those that are not disconnected fromthe bus by load shedding relays. They are energized when the DGbreaker closes. It is not necessary to monitor each permanentlyconnected load.



BASES

SURVEILLANCE SR 3.8.1.7 (continued)REQUIREM ENTS

The DG auto-start and breaker closure time of 10 seconds is derivedfrom requirements of the accident analysis to respond to a design basislarge break LOCA. For this test, the 10-second timing is started whenthe DG receives a start signal, and ends when the DG breaker closes.The safety analyses assume 11 seconds from the loss of power untilthe bus is re-energized.

The requirement to verify that auto-connected shutdown loads areenergized refers to those loads that are actuated by the NormalShutdown Sequencer. Each load should be started to assure that theDG is capable of accelerating these loads at the intervals programmedfor the Normal Shutdown Sequence. The sequenced pumps may beoperating on recirculation flow.

The requirements to maintain steady state voltage and frequency applyto the "steady state" period after all sequenced loads have beenstarted. This period need only be long enough to achieve and measuresteady voltage and frequency.

The Surveillance should be continued for a minimum of 5 minutes inorder to demonstrate that all starting transients have decayed andstability has been achieved. The requirement to supply permanentlyconnected loads for > 5 minutes, refers to the duration of the DGconnection to the associated safeguards bus. It is not intended torequire that sequenced loads be operated throughout the 5-minuteperiod. It is not necessary to monitor each permanently connectedload.

The requirement to verify the connection and supply of permanently andautomatically connected loads is intended to demonstrate the DGloading logic. This testing may be accomplished in any series ofsequential, overlapping, or total steps so that the required connectionand loading sequence is verified.

The Frequency of 18 months is consistent with the recommendations ofRG 1.9 (Ref. 5).

This SR is modified by a Note. The reason for the Note is thatperforming the Surveillance would remove a required offsite circuit fromservice, perturb the electrical distribution system, and challenge safetysystems.



BASES


(continued)

SR 3.8.1.8

RG 1.9 (Ref. 5) recommends demonstration once per 18 months thatthe DGs can start and run continuously at full load capability for aninterval of not less than 24 hours, > 120 minutes of which is at a loadabove its analyzed peak accident loading and the remainder of the timeat a load equivalent to the continuous duty rating of the DG. SR 3.8.1.8only requires > 100 minutes at a load above the DG analyzed peakaccident loading. The 100 minutes required by the SR satisfies theintent of the recommendations of the RG, but allows some tolerancebetween the time requirement and the DG rating. Without thistolerance, the load would have to be reduced at precisely 2 hours tosatisfy the SR without exceeding the manufacturer's rating of the DG.

The DG starts for this Surveillance can be performed either fromstandby or hot conditions.

In order to ensure that the DG is tested under load conditions that areas close to design conditions as possible, yet still provide adequatetesting margin between the specified power factor limit and the DGdesign power factor limit of 0.8, testing must be performed using apower factor of < 0.9. The load band is provided to avoid routineoverloading of the DG. Routine overloading may result in more frequentinspections in accordance with vendor recommendations in order tomaintain DG OPERABILITY.

In addition, a Note to the SR states that momentary transients outsidethe required band do not invalidate this test. This is to assure that aminor change in grid conditions and the resultant change in DG load, ora similar event, does not result in a surveillance being unnecessarilyrepeated.


The 18-month Frequency is consistent with the recommendations ofRG 1.9 (Ref. 5).



BASES


(continued)

SR 3.8.1.9

As recommended by RG 1.9 (Ref. 5), this Surveillance ensures that themanual synchronization and load transfer from the DG to the offsitesource can be made and that the DG can be returned to ready to loadstatus when offsite power is restored. The test is performed while theDG is supplying its associated 2400 V bus, but not necessarily carryingthe sequenced accident loads. The DG is considered to be in ready toload status when the DG is at rated speed and voltage, the outputbreaker is open, the automatic load sequencer is reset, and the DGcontrols are returned to "Unit."


The Frequency of 18 months is consistent with the recommendations ofRG 1.9 (Ref. 5).




BASES


SR 3.8.1.10

If power is lost to bus 1C or 1 D, loads are sequentially connected to thebus by the automatic load sequencer. The sequencing logic controlsthe permissive and starting signals to motor breakers to preventoverloading of the DGs by concurrent motor starting currents. The0.3-second load sequence time tolerance ensures that sufficient timeexists for the DG to restore frequency and voltage prior to applying thenext load and ensures that safety analysis assumptions regarding ESFequipment time delays are met. Logic Drawing E-1 7 Sheet 4 (Ref. 7)provides a summary of the automatic loading of safety related buses.

The Frequency of 18 months is consistent with the recommendations ofRG 1.9 (Ref. 5), takes into consideration plant conditions required toperform the Surveillance, and is intended to be consistent with expectedfuel cycle lengths.


SR 3.8.1.11

In the event of a DBA coincident with a loss of offsite power, the DGsare required to supply the necessary power to ESF systems so that thefuel, PCS, and containment design limits are not exceeded.

The requirement to energize permanently connected loads is met whenthe DG breaker closes, energizing its associated 2400 V bus.Permanently connected loads are those that are not disconnected fromthe bus by load shedding relays. They are energized when the DGbreaker closes. It is not necessary to monitor each permanentlyconnected load. The DG auto-start and breaker closure time of10 seconds is derived from requirements of the accident analysis torespond to a design basis large break LOCA. For this test, the10-second timing is started when the DG receives a start signal, andends when the DG breaker closes. The safety analyses assume11 seconds from the loss of power until the bus is re-energized.



BASES


In addition, a Note to the SR states that momentary transients outsidethe required band do not invalidate this test. This is to assure that aminor change in grid conditions and the resultant change in DG load, ora similar event, does not result in a surveillance being unnecessarilyrepeated.

The requirement to verify that auto-connected shutdown loads areenergized refers to those loads that are actuated by the DBASequencer. Each load should be started to assure that the DG iscapable of accelerating these loads at the intervals programmed for theDBA Sequence. Since the containment spray pumps do not actuate onSIS generated by Pressure Low Pressure, the test should be performedsuch that spray pump starting by the sequencer is also verified alongwith the other SIS loads. The sequenced pumps may be operating onrecirculation flow or in other testing modes. The requirements tomaintain steady state voltage and frequency apply to the "steady state"period after all sequenced loads have been started. This period needonly be long enough to achieve and measure steady voltage andfrequency.

The Surveillance should be continued for a minimum of 5 minutes inorder to demonstrate that all starting transients have decayed andstability has been achieved. The requirement to supply permanentlyconnected loads for _> 5 minutes, refers to the duration of the DGconnection to the associated 2400 V bus. It is not intended to requirethat sequenced loads be operated throughout the 5-minute period. It isnot necessary to monitor each permanently connected load.

The Frequency of 18 months takes into consideration plant conditionsrequired to perform the Surveillance and is intended to be consistentwith an expected fuel cycle length of 18 months.




BASES

REFERENCES 1.

2.

3.

4.

5.

6.

7.

8.

10 CFR 50, Appendix A, GDC 17

Regulatory Guide 1.93, December 1974

Generic Letter 84-15, July 2, 1984

10 CFR 50, Appendix A, GDC 18

Regulatory Guide 1.9, Rev. 3, July 1993

Regulatory Guide 1.137, Rev. 1, October 1979

Palisades Logic Drawing E-17, Sheet 4

Engineering Change 12118


Diesel Fuel, Lube Oil, and Starting AirB 3.8.3

BASES

3.8 ELECTRICAL POWER SYSTEMS

B 3.8.3 Diesel Fuel, Lube Oil, and Starting Air

BASES

BACKGROUND The Diesel Generators (DGs) are provided with a storage subsystemhaving a required fuel oil inventory sufficient to operate one diesel for aperiod of 7 days, while the DG is supplying maximum post-accidentloads. The fuel oil storage subsystem is comprised of the Fuel OilStorage Tank and a fuel oil day tank. This onsite fuel oil capacity issufficient to operate the DG for longer than the time to replenish theonsite supply from offsite sources.

Fuel oil is transferred from the Fuel Oil Storage Tank to either day tankby either of two Fuel Transfer Systems. The fuel oil transfer systemwhich includes fuel transfer pump P-18A can be powered by offsitepower, or by either DG. However, the fuel oil transfer system whichincludes fuel transfer pump P-1 8B can only be powered by offsitepower, or by DG 1-1.

For proper operation of the standby DGs, it is necessary to ensure theproper quality of the fuel oil. Regulatory Guide (RG) 1.137 (Ref. 1)addresses the recommended fuel oil practices as supplemented byANSI N195-1976 (Ref. 2).

The DG lubrication system is designed to provide sufficient lubricationto permit proper operation of its associated DG under all loadingconditions. The system is required to circulate the lube oil to the dieselengine working surfaces and to remove excess heat generated byfriction during operation. The onsite storage is sufficient to ensure7 days of continuous operation. This supply is sufficient supply to allowthe operator to replenish lube oil from offsite sources. Implicit in thisLCO is the requirement to assure, though not necessarily by testing, thecapability to transfer the lube oil from its storage location to the DG oilsump, while the DG is running.

Each DG is provided with an associated starting air subsystem toassure independent start capability. The starting air system is requiredto have a minimum capacity with margin for a DG start attempt withoutrecharging the air start receivers.



BASES


A description of the Safety Analyses applicable in MODES 1, 2, 3, and4 is provided in the Bases for LCO 3.8.1, "AC Sources - Operating";during MODES 5 and 6, in the Bases for LCO 3.8.2, "AC Sources -Shutdown." Since diesel fuel, lube oil, and starting air subsystemssupport the operation of the standby AC power sources, they satisfyCriterion 3 of 10 CFR 50.36(c)(2).

LCO Stored diesel fuel oil is required to have sufficient supply for 7 days offull accident load operation. It is also required to meet specificstandards for quality. Additionally, the ability to transfer fuel oil from thestorage tank to each day tank is required from each of the two transferpumps.

Additionally, sufficient lube oil supply must be available to ensure thecapability to operate at full accident load for 7 days. This requirement isin addition to the lube oil contained in the engine sump.

The starting air subsystem must provide, without the aid of the refillcompressor, sufficient air start capacity, including margin, to assurestart capability for its associated DG.

These requirements, in conjunction with an ability to obtain replacementsupplies within 7 days, support the availability of the DGs. DG day tankfuel requirements are addressed in LCOs 3.8.1 and 3.8.2.

APPLICABILITY DG OPERABILITY is required by LCOs 3.8.1 and 3.8.2 to ensure theavailability of the required AC power to shut down the reactor andmaintain it in a safe shutdown condition following a loss of off-sitepower. Since diesel fuel, lube oil, and starting air support LCOs 3.8.1and 3.8.2, stored diesel fuel oil, lube oil, and starting air are required tobe within limits, and the fuel transfer system is required to beOPERABLE, when either DG is required to be OPERABLE.



BASES

ACTIONS A..1

In this Condition, the available DG fuel oil supply is less than therequired 7 day supply, but enough for at least 6 days. The fuel oilinventory equivalent to a 6 day supply is 28,592 gallons (Ref. 5). Thisinventory is conservatively based on an uprated 2600 kW DG capacity.This condition allows sufficient time to obtain additional fuel and toperform the sampling and analyses required prior to addition of fuel oilto the tank. A period of 48 hours is considered sufficient to completerestoration of the required inventory prior to declaring the DGsinoperable.

B.1

In this Condition, the available DG lube oil supply in storage is less thanthe required 7 day supply, but enough for at least 6 days. The lube oilinventory equivalent to a 6 day supply is 268 gallons (Ref. 5). Thisinventory is conservatively based on an uprated 2600 kW DG capacity.This condition allows sufficient time to obtain additional lube oil. Aperiod of 48 hours is considered sufficient to complete restoration of therequired inventory prior to declaring the DGs inoperable.

C.1, D.1, and E.1

Since DG 1-2 cannot power fuel transfer pump P-1 8B, without P-1 8A,DG 1-2 becomes dependant on offsite power or DG 1-1 for its fuelsupply (beyond the approximately 13.5 hours it will operate on the daytank), and does not meet the requirement for independence. Since thecondition is not as severe as the DG itself being inoperable, 12 hours isallowed to restore the fuel transfer system to operable status prior todeclaring the DG inoperable.

Without P-1 8B, either DG can still provide power to the remaining fueltransfer system. Therefore, neither DG is directly affected. Continuedoperation with a single remaining fuel transfer system, however, mustbe limited since an additional single active failure (P-1 8A) could disablethe onsite power system. Because the loss of P-1 8B is less severethan the loss of one DG, a 7 day Completion Time is allowed.

If both fuel transfer systems are inoperable, the onsite AC sources arelimited to about 13.5 hours duration. Since this condition is not assevere as both DGs being inoperable, 8 hours is allowed to restore onefuel transfer pump to OPERABLE status.



BASES

ACTIONS F.1(continued)

With the stored fuel oil properties, other than viscosity, and water andsediment, defined in the Fuel Oil Testing Program not within therequired limits, but acceptable for short term DG operation, a period of30 days is allowed for restoring the stored fuel oil properties. The mostlikely cause of stored fuel oil becoming out of limits is the addition ofnew fuel oil with properties that do not meet all of the limits. This 30 dayperiod provides sufficient time to determine if new fuel oil, when mixedwith stored fuel oil, will produce an acceptable mixture, or if othermethods to restore the stored fuel oil properties are required. Thisrestoration may involve feed and bleed procedures, filtering, orcombinations of these procedures. Even if a DG start and load wasrequired during this time interval and the fuel oil properties were outsidelimits, there is a high likelihood that the DG would still be capable ofperforming its intended function.

G.1

With a Required Action and associated Completion Time not met, orwith diesel fuel oil, lube oil, or starting air subsystem not within limits forreasons other than addressed by Conditions A, B, or F, the associatedDG may be incapable of performing its intended function and must beimmediately declared inoperable.

In the event that diesel fuel oil with viscosity, or water and sediment isout of limits, this would be unacceptable for even short term DGoperation. Viscosity is important primarily because of its effect on thehandling of the fuel by the pump and injector system; water andsediment provides an indication of fuel contamination. When the fuel oilstored in the Fuel Oil Storage Tank is determined to be out of viscosity,or water and sediment limits, the DGs must be declared inoperable,immediately.



BASES


This SR provides verification that there is an adequate inventory of fueloil in the storage subsystem to support either DG's operation for 7 daysat full post-accident load. The fuel oil inventory equivalent to a 7 daysupply is 33,054 gallons (Ref. 5) when calculated in accordance withReferences 1 and 2. This inventory is conservatively based on anuprated 2600 kW DG capacity. The required fuel storage volume isdetermined using the most limiting energy content of the stored fuel.Using the known correlation of diesel fuel oil absolute specific gravity orAPI gravity to energy content, the required diesel generator output, andthe corresponding fuel consumption rate, the onsite fuel storage volumerequired for 7 days of operation can be determined. SR 3.8.3.3 requiresnew fuel to be tested to verify that the absolute specific gravity or APIgravity is not less than the value assumed in the diesel fuel oilconsumption calculations. The 7 day period is sufficient time to placethe plant in a safe shutdown condition and to bring in replenishment fuelfrom an offsite location.

The 24 hour Frequency is specified to ensure that a sufficient supply offuel oil is available, since the Fuel Oil Storage Tank is the fuel oil supplyfor the diesel fire pumps, heating and evaporator boilers, in addition tothe DGs.

SR 3.8.3.2

This Surveillance ensures that sufficient stored lube oil inventory isavailable to support at least 7 days of full accident load operation forone DG. The lube oil inventory equivalent to a 7 day supply is 313gallons and is based on an estimated consumption of 1.0% of fuel oilconsumption (Ref. 5). This inventory is also conservatively based on anuprated 2600 kW DG capacity.

A 31 day Frequency is adequate to ensure that a sufficient lube oilsupply is onsite, since DG starts and run times are closely monitored bythe plant staff.

SR 3.8.3.3

The tests listed below are a means of determining whether new fuel oiland stored fuel oil are of the appropriate grade and have not beencontaminated with substances that would have an immediate,detrimental impact on diesel engine combustion.

Testing for viscosity, specific gravity, and water and sediment iscompleted for fuel oil delivered to the plant prior to its being added tothe Fuel Oil Storage Tank. Fuel oil which fails the test, but has not been



BASES


added to the Fuel Oil Storage Tank does not imply failure of this SR andrequires no specific action. If results from these tests are withinacceptable limits, the fuel oil may be added to the storage tank withoutconcern for contaminating the entire volume of fuel oil in the storagetank.

Fuel oil is tested for other of the parameters specified in ASTM D975(Ref. 3) in accordance with the Fuel Oil Testing Program required bySpecification 5.5.11. Fuel oil determined to have one or moremeasured parameters, other than viscosity or water and sediment,outside acceptable limits will be evaluated for its effect on DG operation.Fuel oil which is determined to be acceptable for short term DG

operation, but outside limits will be restored to within limits inaccordance with LCO 3.8.3 Condition F.

SR 3.8.3.4

This Surveillance ensures that, without the aid of the refill compressor,sufficient air start capacity for each DG is available. The pressurespecified in this SR is intended to reflect the acceptable margin fromwhich successful starts can be accomplished.

The 31 day Frequency takes into account the capacity, capability,redundancy, and diversity of the AC sources and other indicationsavailable in the control room, including alarms, to alert the operator tobelow normal air start pressure.

SR 3.8.3.5

Microbiological fouling is a major cause of fuel oil degradation. Thereare numerous bacteria that can grow in fuel oil and cause fouling, but allmust have a water environment in order to survive. Removal of waterfrom the Fuel Oil Storage Tank once every 92 days eliminates thenecessary environment for bacterial survival. This is the most effectivemeans of controlling microbiological fouling. In addition, it reduces thepotential for water entrainment in the fuel oil during DG operation.Water may come from any of several sources, including condensation,ground water, rain water, contaminated fuel oil, and from breakdown ofthe fuel oil by bacteria. Frequent checking for and removal ofaccumulated water minimizes fouling and provides data regarding thewatertight integrity of the fuel oil system. The Surveillance Frequenciesand acceptance criteria are established in the Fuel Oil Testing Programbased, in part, on those recommended by RG 1.137 (Ref. 1). This SRis for preventative maintenance.



BASES


SR 3.8.3.6

The presence of water does not necessarily represent failure of this SRprovided the accumulated water is removed in accordance with therequirements of the Fuel Oil Testing Program.

This SR demonstrates that each fuel transfer pump and the fuel transfersystem controls operate and control transfer of fuel from the Fuel OilStorage Tank to each day tank and engine mounted tank. This isrequired to support continuous operation of standby power sources.

This SR provides assurance that the following portions of the fuel

transfer system is OPERABLE:

a. Fuel Transfer Pumps;

b. Day and engine mounted tank filling solenoid valves; and

c. Day and engine mounted tank automatic level controls.

The 92 day Frequency corresponds to the! testing requirements forpumps in the ASME Code, Section XI (Ref. 4). Additional assurance offuel transfer system OPERABILITY is provided during the monthlystarting and loading tests for each DG when the fuel oil system willfunction to maintain level in the day and engine mounted tanks.

REFERENCES 1. Regulatory Guide 1.137

2. ANSI N195-1976

3. ASTM Standards, D975, Table 1

4. ASME, Boiler and Pressure Vessel Code, Section XI

5. Engineering Analysis EA-EC6432-01


I

Documents

Entergy Nuclear Operations, Inc. En bnfff-ql Covert, MI ...Entergy Nuclear Operations, Inc. En Palisades Nuclear Plant bnfff-ql 27780 Blue Star Memorial Highway JL_.JILL.'1 Covert,