ML091060725

Submittal of Technical Specifications Bases Changes and Technical Requirements Manual Changes

ML091060725
Person / Time
Site:	Kewaunee
Issue date:	04/07/2009
From:	Wilson M Dominion Energy Kewaunee
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
Download: ML091060725 (55)

Text

Dominion Energy Kewaunee, Inc. 0 N490 Highway 42, Kewaunee, WI 54216-9511 APR 0 7 2009 ATTN: Document Control Desk Serial No.09-169 U. S. Nuclear Regulatory Commission LIC/NW/RO Washington, DC 20555-0001 Docket No.: 50-305 License No.: DPR-43 DOMINION ENERGY KEWAUNEE, INC.

KEWAUNEE POWER STATION TECHNICAL SPECIFICATIONS BASES CHANGES AND TECHNICAL REQUIREMENTS MANUAL CHANGES Pursuant to Kewaunee Power Station (KPS) Technical Specification 6.21, "Technical Specifications (TS) Bases Control Program," Dominion Energy Kewaunee, Inc. (DEK) hereby submits changes to the TS Bases.

Additionally, DEK submits changes to the KPS Technical Requirements Manual (TRM).

10 CFR 50.71(e)(4) states the requirements for submittal of the KPS Updated Safety Analysis Report (USAR). As the KPS TRM is considered a part of the USAR by reference, it is also required to be submitted to the Nuclear Regulatory Commission (NRC).

The attachments provide copies of the KPS TS Bases and TRM pages reflecting the changes implemented since April 2008. The Core Operating Limits Reports, Cycle 29 Revision 0 and Revision 1, were submitted April 25, 2008 (reference 1).

The changes to the TS Bases and TRM were made in accordance with the provisions of 10 CFR 50.59 and approved by the KPS Facility Safety Review Committee.

If you have questions or require additional information, please feel free to contact Mr.

Jack Gadzala at 920-388-8604.

Very truly yours, Mich el J. Wilson Director Safety and Licensing

Serial No.09-169 Page 2 of 2

Reference:

1. Letter from Michael J. Wilson (DEK) to Document Control Desk (NRC), "Cycle 29 Core Operating Limits Reports," dated April 25, 2008. (ADAMS Accession No. ML081230658)

Attachments:

1. Kewaunee Power Station Technical Specifications Bases Changes

2. Kewaunee Power Station Technical Requirements Manual Changes Commitments made by this letter: NONE cc: Regional Administrator, Region III U. S. Nuclear Regulatory Commission 2443 Warrenville Road Suite 210 Lisle, IL 60532-4352 Mr. P. S. Tam Sr. Project Manager U.S. Nuclear Regulatory Commission One White Flint North, Mail Stop 08-H4A 11555 Rockville Pike Rockville, MD 20852-2738 NRC Senior Resident Inspector Kewaunee Power Station

Serial No.09-169 ATTACHMENT 1 TECHNICAL SPECIFICATIONS BASES CHANGES AND TECHNICAL REQUIREMENTS MANUAL CHANGES KEWAUNEE POWER STATION TECHNICAL SPECIFICATIONS BASES CHANGES TS BASES PAGES:

TS B3.7-1 (issued 417/08)

TS B3.7-2 (issued 4/7/08)

TS B4.6-1 (issued 4/7/08)

TS B4.6-2 (issued 417/08)

TS B4.6-3 (issued 4/7/08)

TS B2.3-2 (issued 4/15/08)

TS B3.5-3 (issued 4/15/08)

TS B3.5-4 (issued 4/15/08)

TS B3.5-5 (issued 4/15/08)

TS B3.5-6 (issued 4/15/08)

TS B3.5-3 (issued 4/22/08)

TS B2.1-1 (issued 4/24/08)

TS B2.1-2 (issued 4/24/08)

TS B3.1-1 (issued 4/24/08)

TS B3.1-14 (issued 4/24/08)

TS B3.10-2 (issued 4/24/08)

TS B3.10-3 (issued 4/24/08)

TS B3.10-4 (issued 4/24/08)

TS B3.10-7 (issued 4/24/08)

TS B3.10-8 (issued 4/24/08)

TS B3.8-1 (issued 1/15/09)

TS B4.4-3 (issued 1/29/09)

TS B3.5-2 (issued 2/5/09)

TS B3.5-3 (issued 2/5/09)

TS B3.5-4 (issued 2/5/09)

TS B3.5-5 (issued 2/5/09)

TS B3.5-6 (issued 2/5/09)

TS B3.5-7 (issued 2/5/09)

TS B3.5-8 (issued 2/5/09)

TS B3.5-9 (issued 2/5/09)

TS B3.7-1 (issued 2/6109)

TS B3.7-2 (issued 2/6/09)

KEWAUNEE POWER STATION DOMINION ENERGY KEWAUNEE, INC.

Serial No.09-169 ATTACHMENT 2 TECHNICAL SPECIFICATIONS BASES CHANGES AND TECHNICAL REQUIREMENTS MANUAL CHANGES KEWAUNEE POWER STATION TECHNICAL REQUIREMENTS MANUAL CHANGES TRM PAGES:

TRM 3.7.2-1 (issued 417108)

TRM 1.0-1 (issued 8128/08)

TRM 1.0-2 (issued 8/28/08)

TRM 3.5.1-1 (issued 8/28/08)

TRM 3.5.1-2 (issued 8/28/08)

TRM 3.8.1-1 (issued 1/15/09)

TRM 3.8.1-2 (issued 1/15/09)

TRM 3.8.1-3 (issued 1/15/09)

TRM 3.5.6-1 (issued 1/29/09)

TRM 3.5.6-2 (issued 1/29/09)

TRM 3.5.6-3 (issued 1/29/09)

TRM 3.5.6-4 (issued 1/29/09)

TRM 3.5.6-5 (issued 1/29/09)

TRM 3.5.6-6 (issued 1/29/09)

TRM 3.4.1-1 (issued 2/18/09)

TRM 3.4.1-2 (issued 2/18/09)

TRM 3.4.1-3 (issued 2/18/09)

TRM 3.4.1-4 (issued 2/18/09)

TRM 3.4.1-5 (issued 2/18/09)

KEWAUNEE POWER STATION DOMINION ENERGY KEWAUNEE, INC.

BASIS - Auxiliary Electrical Systems (TS 3.7)

The intent of this TS is to provide assurance that at least one external source and one standby source of electrical power is always available to accomplish safe shutdown and containment isolation and to operate required engineered safety features equipment following an accident.

Plant safeguards auxiliary power is normally supplied by two separate external power sources which have multiple off-site network connections (1): the reserve auxiliary transformer from the 138-Kv portion of the plant substation, and a tertiary winding on the substation auto transformer. Either source is sufficient to supply all necessary accident and post-accident load requirements from any one of four available transmission lines.

Each diesel generator is connected to one 4160-V safety features bus and has sufficient capacityto start sequentially and operate the engineered safety features equipment supplied by that bus. The set of safety features equipment items supplied by each bus is, alone, sufficient to maintain adequate cooling of the fuel and to maintain containment pressure within the design value in the event of a loss-of-coolant accident.

Each diesel generator starts automatically upon low voltage on its associated bus, and both diesel generators start in the event of a safety injection signal.(2) A minimum of 7 days fuel supply for one diesel generator is maintained by requiring 36,000 gallons of fuel oil, thus assuring adequate time to restore off-site power or to replenish fuel. The diesel fuel oil storage capacity requirements are consistent with those specified in ANSI N1 95-1976/ANS-59.51, Sections 5.2, 5.4, and 6.1.

The plant safeguards 125-V d-c power is normally supplied by two batteries each of which will have a battery charger in service to maintain full charge and to assure adequate power for starting the diesel generators and supplying other emergency loads. A third charger is available to supply either battery.(3)

The arrangement of the auxiliary power sources and equipment and this TS ensure that no single fault condition will deactivate more than one redundant set of safety features equipment items and will therefore not result in failure of the plant protection systems to respond adequately to a loss-of-coolant accident.

DG Operability Testing With One Inoperable DG - (TS 3.7.b.2)

TS 3.7.b.2.A provides an allowance to avoid unnecessary testing of the OPERABLE DG. Ifit can be determined that the cause of the inoperable DG does not exist on the OPERABLE DG, SR 4.6.a.1.A is not required to be performed. If the cause of the operability exists on the OPERABLE DG, the other DG would be declared inoperable upon discovery and TS 3.7.b.7 would be entered. Once the common cause failure is repaired on both DGs, the common cause failure no longer exists, and TS 3.7.b.2 is satisfied. Ifthe cause of the initial inoperable DG cannot be confirmed not to exist on the remaining DG, or it is decided not to pursue a common cause evaluation, performance of SR 4.6.a.1 .Asuffices to provide assurance of continued OPERABILITY of the OPERABLE DG. Inthe event the inoperable DG is restored to OPERABLE status prior to completing either 3.7.b.2.A or 3.7.b.2.8, the corrective action program will continue to evaluate the common cause possibility.

This continued evaluation, however, is no longer under the 24-hour constraint imposed while in TS

(" USAR Figure 8.2-1 and 8.2-2 (2) USAR Section 8.2.3 (3)USAR Section 8.2.2 and 8.2.3 TS B3.7-1 Amendment No. 194 02/07/2008

3.7.b.2. According to Generic Letter 84-15, 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is a reasonable time frame to confirm that the OPERABLE DG(s) is not affected by the same problem as the inoperable DG.

Operation may continue in TS 3.7.b.2 for a period to not exceed 7 days. In TS 3.7.b.2, the remaining OPERABLE DG and offsite circuits are adequate to supply electrical power to the onsite Class I E Distribution System. The 7-day completion time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during the period.

Two DGs Inoperable Concurrently For Up To Two Hours - (TS 3.7.b.7)

With Train A and Train B DGs inoperable, there are no remaining standby AC sources. Thus, with an assumed loss of offsite electrical power, insufficient standby AC sources are available to power the minimum required ESF functions. Since the offsite electrical power system is the only source of AC power for this level of degradation, the risk associated with continued operation for a very short time could be less than that associated with an immediate controlled shutdown. Since any inadvertent generator trip could also result in a total loss of offsite AC power, the time allowed for continued operation is severely restricted. The intent here is to avoid the risk associated with an immediate controlled shutdown and to minimize the risk associated with this level of degradation.

According to Regulatory 1.93, with both DGs inoperable, operation may continue for a period that should not exceed 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

TS B3.7-2 Amendment No. 194 02/07/2008

BASIS - Periodic Testing of Emergency Power Systems (TS 4.6)

Each diesel generator can start and be ready to accept full load within 10 seconds, and will sequentially start and supply the power requirements for one complete set of engineered safety features equipment in approximately one minute.(1 ) This test will be conducted during each REFUELING outage to ensure that the diesel generator will start and assume required loads in accordance with the timing sequence listed in USAR Table 8.2-1 after the initial starting sequence.

The specified test frequencies provide reasonable assurance that any mechanical or electrical deficiency will be detected and corrected before it can result in failure of one emergency power supply to respond when called upon to function. Its possible failure to respond is, of course, anticipated by providing two diesel generators, each supplying through an independent bus, a complete and adequate set of engineered safety features equipment. Further, both diesel generators are provided as backup to multiple sources of external power, and this multiplicity of sources should be considered with regard to adequacy of test frequency.

Notes, TS 4.6.a.1 .A and TS 4.6.a.2 These SRs are intended to confirm continued availability of standby electrical power supplies, which may be used to mitigate DBAs and transients and to maintain the unit in a safe shutdown condition. To minimize the wear on moving parts that do not get lubricated when the DG is not running, these SRs are modified by a Note to indicate that all DG starts for these Surveillances may be preceded by an engine prelube period and followed by a warmup period prior to loading.

For the purposes of SR 4.6.a.1.A and SR 4.6.a.2 testing, the DGs are started from standby conditions. Standby conditions for a DG mean that the diesel engine coolant and oil are being continuously circulated and temperature is being maintained consistent with manufacturer recommendations.

In order to reduce stress and wear on diesel engines, the manufacturer of KPS DGs recommends a modified start in which the starting speed of DGs is limited, warmup is limited to this lower speed, and the DGs are gradually accelerated to synchronous speed prior to loading. These start procedures are the intent of Note 2, which is only applicable when such modified start procedures are recommended by the manufacturer.

Monthly Diesel Generator Surveillance (TS 4.6.a.1)

The monthly tests specified for the diesel generators will demonstrate their continued capability to start and carry rated load. The fuel supplies and starting circuits and controls are continuously monitored, and abnormal conditions in these systems would be indicated by an alarm without need for test startup. Monthly tests are performed in accordance with the intent of IEEE 387-1977, paragraph 6.6.1. The steady state bands of >4000 and _54400 for voltage and >

60 and _<61 for frequency are based on calculations involved with electrical auxiliary system study and safeguards diesel generator loading adjustment for operations other than 60 Hz.

REFUELING Interval Diesel Generator Surveillance (TS 4.6.a.2)

The REFUELING interval diesel generator surveillance demonstrates that the Emergency Power (1)USAR Section 8.2 Amendment No. 194 TS B4.6-1 02/07/2008

System, and its control system, will function automatically to provide engineered safety equipment power in the event of loss of off-site power coincident with a safety injection signal. This test demonstrates proper tripping of motor feeder breakers, main supply and tie breakers on the affected bus, and sequential starting of essential equipment to demonstrate OPERABILITY of the diesel generators. This test is initiated by simultaneously unblocking safety injection and simulating a loss-of-voltage signal. (Note also that Reg. Guide 1.108 addresses diesel generator surveillance.)

REFUELING Interval Diesel Generator Inspection TS 4.6.a.3 Inspections are performed at REFUELING outage intervals in order to maintain the diesel generators in accordance with the manufacturers' recommendations. The inspection procedure is periodically updated to reflect experience gained from past inspections and new information as it is available from the manufacturer.

18-Month Load Rejection Test TS 4.6.a.4 The load rejection test demonstrates the capability of rejecting the maximum rated load without overspeeding or attaining voltages which would cause the diesel generator to trip, mechanical damage, or harmful overstresses.

Operating Cycle Short-Term Load Test- TS 4.6.a.5 Loading the diesel generators to their short-term rating will demonstrate their capability to provide a continuous source of emergency AC power during a load perturbation of up to 110% of the diesel generator's continuous rating.

IEEE 387-1977 paragraph 3.7.2, defines a diesel generators short time rating. Paragraph 6.4.3 defines the rated load test for diesel generators, item 2 states to load the diesel generator to the short time rating for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. Paragraph 6.6.2 describes the operational testing to be performed for the diesel generators. Although the rated load test is not listed in paragraph 6.6.2, item 2 of paragraph 6.4.3 has been determined to be necessary to be performed on the emergency diesel generators.

NRC Regulatory Guide 1.9, Revision 2, Regulatory Position 14, describes the method in which this test should be performed. This test follows Position 14 except that instead of the continuous rating load being applied for 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br /> the KPS emergency diesel generators shall be loaded to 2700 kW for 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br />. Loading the emergency diesel generators to 2700 kW is acceptable because it will bound the post-accident emergency diesel generator loads without increasing the frequency of the 18-month diesel inspection surveillance. The diesel generator starts for this Surveillance can be performed either from standby or hot conditions. The provisions for prelubricating, warmup, and for gradual loading are applicable to this surveillance requirement.

The "once per operating cycle" frequency is consistent with the recommendations of IEEE Std.

387-1977, paragraph 6.6.2, and takes into consideration unit conditions required to perform the Surveillance, and is intended to be consistent with expected fuel cycle lengths.

Three notes modify this Surveillance. Note 1 states that momentary transients due to changing busloads do not invalidate this test. Similarly, momentary power factor transients above the Amendment No. 194 TS B4.6-2 02/07/2008

power factor operation will not invalidate the test. The reason for Note 2 is that during operation with the reactor critical, performance of this Surveillance could cause perturbations to the electrical distribution systems that could challenge continued steady state operation and, as a result, unit safety systems. This restriction from normally performing the Surveillance in the OPERATING or HOT STANDBY MODE is further amplified to allow the Surveillance to be performed for reestablishing OPERABILITY (e.g., post work testing following corrective maintenance, corrective modification, deficient or incomplete surveillance testing, and other unanticipated OPERABILITY concerns) provided an assessment determines plant safety is maintained or enhanced. This assessment shall, as a minimum, consider the potential outcomes and transients associated with a failed Surveilla'nce, a successful Surveillance, and a perturbation of the offsite or onsite system when they are tied together or operated independently for the Surveillance; as well as the operator procedures available to cope with these outcomes. These shall be measured against the avoided risk of a plant shutdown and startup to determine that plant safety is maintained or enhanced when the Surveillance is performed in the OPERATING or HOT STANDBY MODE. Risk insights or deterministic methods may be used for this assessment. Credit may be taken for unplanned events that satisfy this surveillance requirement.

Note 3 ensures that the DG is tested under load conditions that are as close to design basis conditions as possible. When synchronized with offsite power, testing should be performed at a power factor of < 0.89. This power factor is representative of the actual inductive loading a DG would see under design basis accident conditions. Under certain conditions, however, Note 3 allows the Surveillance to be conducted as a power factor other than < 0.89. These conditions occur when grid voltage is high, and the additional field excitation needed to get the power factor to < 0.89 results in voltages on the emergency busses that are too high. Under these conditions, the power factor should be maintained as close as practicable to 0.89 while still maintaining acceptable voltage limits on the emergency busses. In other circumstances, the grid voltage may be such that the DG excitation levels needed to obtain a power factor of < 0.89 may not cause unacceptable voltages on the emergency busses, but the excitation levels are in excess of those recommended for the diesel generator. In such cases, the power factor shall be maintained close as practicable to 0.89 without exceeding the diesel generator excitation limits. When conditions exist where the testing is performed at a power factor greater than 0.89, the circumstances surrounding the conditions need be documented. The tests documented in TS Bases 4.6.a.2, 4.6.a.4, and 4.6.a.5 meet the intent of IEEE 387-1977, paragraph 6.6.2.

Station Batteries, TS 4.6-b Station batteries will deteriorate with time, but precipitous failure is extremely unlikely. The surveillance specified is that which has been demonstrated over the years to provide indication of a cell becoming unserviceable long before it fails.

If a battery cell has deteriorated, or if a connection is loose, the voltage under load will drop excessively, indicating need for replacement or maintenance.

Amendment No. 194 TS B4.6-3 02/07/2008

The overpower AT reactor trip prevents power density anywhere in the core from exceeding a value at which fuel pellet centerline melting would occur, and includes corrections for change in density and heat capacity of water with temperature, and dynamic compensation for piping delays from the core to the loop temperature detectors. The specified setpoints meet this requirement and include allowance for instrument errors.(2)

The overpower and overtemperature PROTECTION SYSTEM setpoints include the effects of fuel densification and clad flattening on core SAFETY LIMITS. 4 )

Reactor Coolant Flow The low-flow reactor trip protects the core against DNB in the event of either a decreasing actual measured flow in the loops or a sudden loss of power to one or both reactor coolant pumps. The setpoint specified is consistent with the value used in the accident analysis.(5)

The undervoltage and low frequency reactor trips provide additional protection against a decrease in flow. The undervoltage setting provides a direct reactor trip and a reactor coolant pump breaker trip. The undervoltage setting ensures a reactor trip signal will be generated before the low-flow trip setting is reached. The low frequency setting provides only a reactor coolant pump breaker trip.

Steam Generators The low-low steam generator water level reactor trip ensures that there will be sufficient water inventory in the steam generators at the time of trip to allow for starting the Auxiliary Feedwater (6)

System.

Reactor Trip Interlocks Specified reactor trips are bypassed at low power where they are not required for protection and would otherwise interfere with normal operation. The prescribed setpoints above which these trips are made functional ensures their availability in the power range where needed.

Confirmation that bypasses are automatically removed at the prescribed setpoints will be determined by periodic testing. The reactor trips related to loss of one or both reactor coolant pumps are unblocked at approximately 10% of power.

The interlock used to automatically block/unblock the single-loop loss of flow reactor trip (TS 2.3.a.6.B) is designated P-8. The interlock used to automatically. block/unblock the other at-power reactor trips (TS 2.3.a.6.A) is designated P-7. The coincidence and setting limits for these interlocks are located in the Notes for TS Table 3.5-2, "Instrument Operation Conditions For Reactor Trip."

Table TS 3.5-1 lists the various parameters and their setpoints which initiate safety- injection signals. A safety injection signal (SIS) also initiates a reactor trip signal. The periodic testing will verify that safety injection signals perform their intended function. Refer to the basis of Section 3.5 of these specifications for details of SIS signals.

(4) WCAP-8092 (5)USAR Section 14.1.8 (6) USAR Section 14.1.10 Amendment No. 195 TS B2.3-2 03/28/2008

4. The steam line low-pressure signal.is lead/lag compensated and its setpoint is set well above the pressure expected in the event of a large steam line break accident as shown in the safety analysis.

5. The high steam line flow limit is set at approximately20% of nominal full-load flow atthe no-load pressure and the Hi-Hi steam line flow limit is set at approximately 120% of nominal full-load flow at the full-load pressure in order to protect against large steam line break accidents. The coincident Lo-Lo Tavg setting limit for steam line isolation initiation is set below its HOT SHUTDOWN value. The safety analysis shows that these settings provide protection in the event of a large steam line break.

6. The setpoints and associated ranges for the undervoltage relays have been established to always maintain motor voltages at or above 80% of their nameplate rating, to prevent prolonged operation of motors below 90% of their nameplate rating, and to prevent prolonged operation of 480 V MCC starter contactors at inrush currents.(4) All safeguard motors were designed to accelerate their loads to operating speed with 80% nameplate voltage, but not necessarily within their design temperature rise. Prolonged operation below 90% of nameplate voltage may result in shortening of motor insulation life, but short-term operation below 90% of nameplate voltage will not result in unacceptable effects due~to the service factor provided in the motors and the conservative insulation system used on the motors. Prolonged operation of MCC contactors at inrush currents may result in blown control fuses and inoperable equipment; therefore operation will be limited to a time less than it takes for a fuse to blow.

The primary safeguard buses undervoltage trip (85.0b% of nominal bus voltage) is designed to protect against a loss of voltage to the safeguard bus and assures that safeguard protection action will proceed as assumed in the USAR. The associated time delay feature prevents inadvertent actuation of the undervoltage relays from voltage dips, while assuring that the diesel generators will reach full capacity before the Safety Injection pump loads are sequenced on.

The safeguard buses second level undervoltage trip (93.6% nominal bus voltage) is designed to protect against prolonged operation below 90% of nameplate voltage of safeguard pumps. The time delay of less than 7.4 seconds ensures that engineered safeguards equipment operates within the time delay assumptions of the accident analyses. The time delay will prevent blown control fuses in 480 V MCC's; the MCC control fuses are the limiting component for long-term low voltage operation. The time delay is long enough to prevent inadvertent actuation of the second level UV relays from voltage dips due to large moto.r starts (except reactor coolant pump starts with a safeguards bus below 3980 volts). Up to 7.4 seconds of operation of safeguard pumps between 80% and 90% of nameplate voltage is acceptable due to the service factor and conservative insulation designed into the motors.

Each relay in the undervoltage protection channels will fail safe and is alarmed to alert the operator to the failure.

A blackout signal which occurs during the sequence loading following a Safety Injection signal will result in a re-initiation of the sequence loading logic at time step 0 as long as the Safety Injection signal has not been reset. The Kewaunee Emergency Procedures warn the operators that a Blackout Signal occurring after reset of Safety Injection will not actuate the sequence loading and instructs to re-initiate Safety Injection if needed.

(4) USAR section 8.2.3 TS B3.5-3 04/23/2001

Instrument OPERATING Conditions During plant OPERATIONS, the complete protective instrumentation systems will normally be in service. Reactor safety is provided by the Reactor Protection Systems, which automatically initiates appropriate action to prevent exceeding established limits. Safety is not compromised, however, by continuing OPERATION with certain instrumentation channels out of service since provisions were made for this in the plant design. This specification outlines LIMITING CONDITIONS FOR OPERATION necessary to preserve the effectiveness of the Reactor Control and PROTECTION SYSTEM when any one or more of the channels is out of service.

Almost all reactor protection channels are supplied with sufficient redundancy to provide the capability for CHANNEL CALIBRATION and test at power. Exceptions are backup channels such as reactor coolant pump breakers. The removal of one trip channel on process control equipment is accomplished by placing that channel bistable in a tripped mode; e.g., a two-out-of-three circuit becomes a one-out-of-two circuit. The source and intermediate range nuclear instrumentation system channels are not intentionally placed in a tripped mode since these are one-out-of-two trips, and the trips are therefore bypassed during testing. Testing does not trip the system unless a trip condition exists in another channel.

The OPERABILITY of the instrumentation noted in Table TS 3.5-6 assures that sufficient information is available on these selected plant parameters to aid the operator in identification of an accident and assessment of plant conditions during and following an accident. In the event the instrumentation noted in Table TS 3.5-6 is not OPERABLE, the operator is given instruction on compensatory actions.

Reactor Trip Permissives/Interlocks~ 5 )

Low Power Reactor Trips Block, P-7 The Low Power Reactor Trips Block, P-7 interlock is actuated by input from the Power Range Neutron Flux, P-1 0, or the Turbine Impulse Pressure, P-1 3, interlock. The P-7 interlock ensures that the following Functions are performed:

(1) on increasing power, the P-7 interlock automatically enables reactor trips on the following Functions:

, Pressurizer Pressure - Low,

• Pressurizer Water Level - High,

• Reactor Coolant Flow - Low (low flow in two RCS loops),

• RCPs Breaker Open (Two Loops),

• Undervoltage RCPs, and

• Underfrequency RCPs.

These reactor trips are only required when operating above the P-7 setpoint (approximately 10% power). The reactor trips provide protection against violating the departure from nucleate boiling ratio (DNBR) limit. Below the P-7 setpoint, the RCS is capable of providing sufficient natural circulation without any RCP running. Prior to exceeding 12.2% rated power these trips must be enabled as required by TS 2.3.a.6.A.

(5)USAR Section 7.4.2 TS B3.5-4 Amendment No. 195 03/28/2008

(2) on decreasing power, the P-7 interlock automatically blocks reactor trips on the following Functions:

• Pressurizer Pressure - Low,

• Pressurizer Water Level - High,

• Reactor Coolant Flow - Low (low flow in two RCS loops),

• RCP Breaker Position (Two Loops),

• Undervoltage RCPs, and

• Underfrequency RCPs.

Trip Setpoint and Allowable Value are not applicable to the P-7 interlock because it is a logic function and thus has no parameter with which to associate a limiting safety system setting (LSSS). The P-7 interlock is a logic function with train and not channel identity. The low power trips are blocked below the P-7 setpoint and unblocked above the P-7 setpoint.

Power Range Neutron Flux, P-8 The Power Range Neutron Flux, P-8 interlock is actuated on increasing power at approximately 10% power as determined by two-out-of-four NIS power range detectors. The P-8 interlock automatically enables the Reactor Coolant Flow - Low and RCP Breaker Position (Single Loop) reactor trips when reactor power increases to above 10% rated power. Enabling the Reactor Coolant Flow - Low and RCP Breaker Position (Single Loop) reactor trips ensures that protection is provided against a loss of flow in one or both RCS loops that could result in DNB conditions in the core when greater than approximately 10% power. On decreasing power, the reactor trips on low flow if any loop is automatically blocked.

Above 10% rated power, a loss of flow in one or both RCS loops could result in DNB conditions.

To prevent a DNB condition from occurring on a loss of flow in one or both RCS loops, the Power Range Neutron Flux, the Reactor Coolant Flow - Low and RCP Breaker Position (Single Loop) reactor trips must be OPERABLE above 10% of rated power. Below 10% of rated power, these trips do not have to be OPERABLE because the core is not producing sufficient power to be concerned about DNB conditions.

Prior to exceeding 10% rated power, these trips must be enabled as required by TS 2.3.a.6.B.

Power Range Neutron Flux, P-1 0 The Power Range Neutron Flux, P-10 permissive is actuated at approximately 10% power, as determined by two-out-of-four NIS power range detectors. If power level falls below 10% of rated power on 3 of 4 channels, the Power Range High Flux - Low Setpoint and Intermediate Range High Flux nuclear instrument trips will be automatically unblocked. The P-10 permissive ensures that the following Functions are performed:

• On increasing power, the P-1 0 permissive allows the operator to manually block the Intermediate Range Neutron Flux reactor trip. Note that blocking the reactor trip also blocks the signal to prevent automatic and manual rod withdrawal.

• On increasing power, the P-10 permissive allows the operator to manually block the Power Range High Flux - Low Setpoint reactor trip.

" On increasing power, the P-10 permissive automatically provides a backup signal to TS B3.5-5 Amendment No. 195 03/28/2008

block the Source Range Neutron Flux reactor trip.

" On decreasing power (3 of 4 NIs less than approximately 10% rated power) the P-10 permissive provides one of the two inputs to the P-7 interlock.

" On decreasing power, the P-10 permissive automatically enables the Power Range High Flux - Low Setpoint reactor trip and the Intermediate Range High Flux reactor trip and rod stop.

Prior to reactor power decreasing below 7.8% rated power, the power range high flux - low setpoint reactor trip and the intermediate range high flux reactor trip must be enabled.

Turbine Impulse Pressure, P-13 The Turbine Impulse Pressure, P-13 interlock is actuated when one-of-two pressure instruments in the first stage of the high-pressure turbine indicates greater than approximately 10% of the rated full power turbine impulse pressure. The P-i3 interlock provides one of the two inputs to the P-7 interlock. When two-of-two turbine impulse pressure channels indicate less than approximately 10% turbine power, the P-13 interlock is deactivated. When P-13 is deactivated, P-7 is provided with one of the two inputs necessary to block the at-power trips, the other input being P-10.

TS B3.5-6 Amendment No. 195 03/28/2008

4. The steam line low-pressure signal is lead/lag compensated and its setpoint is set well above the pressure expected in the event of a large steam line break accident as shown in the safety analysis.

5. The high steam line flow limit is set at approximately 20% of nominal full-load flow at the no-load pressure and the Hi-Hi steam line flow limit is set at approximately 120% of nominal full-load flow at the full-load pressure in order to protect against large steam line break accidents. The coincident Lo-Lo Tavg setting limit for steam line isolation initiation is set below its HOT SHUTDOWN value. The safety analysis shows that these settings provide protection in the event of a large steam line break.

6. The setpoints and associated ranges for the undervoltage relays have been established to always maintain motor voltages at or above 80% of their nameplate rating, to prevent prolonged operation of motors below 90% of their nameplate rating, and to prevent prolonged operation of 480 V MCC starter contactors at inrush currents.(4) All safeguard motors were designed to accelerate their loads to operating speed with 80% nameplate voltage, but not necessarily within their design temperature rise. Prolonged operation below 90% of nameplate voltage may result in shortening of motor insulation life, but short-term operation below 90% of nameplate voltage will not result in unacceptable effects due to the service factor provided in the motors and the conservative insulation system used on the motors. Prolonged operation of MCC contactors at inrush currents may result in blown control fuses and inoperable equipment; therefore operation will be limited to a time less than it takes for a fuse to blow.

The primary safeguard buses undervoltage trip (84.47% of nominal bus voltage) is designed to protect against a loss of voltage to the safeguard bus and assures that safeguard protection action will proceed as assumed in the USAR. The associated time delay feature prevents inadvertent actuation of the undervoltage relays from voltage dips, while assuring that the diesel generators will reach full capacity before the Safety Injection pump loads are sequenced on.

The safeguard buses second level undervoltage trip (93.8% nominal bus voltage) is designed to protect against prolonged operation below 90% of nameplate voltage of safeguard pumps. The time delay of less than 7.4 seconds ensures that engineered safeguards equipment operates within the time delay assumptions of the accident analyses. The time delay will prevent blown control fuses in 480 V MCC's; the MCC control fuses are the limiting component for long-term low voltage operation. The time delay is long enough to prevent inadvertent actuation of the second level UV relays from voltage dips due to large motor starts (except reactor coolant pump starts with a safeguards bus below 3980 volts). Up to 7.4 seconds of operation of safeguard pumps between 80% and 90% of nameplate voltage is acceptable due to the service factor and-conservative insulation designed into the motors.

Each relay in the undervoltage and degraded voltage protection channels will fail safe on loss of AC input power and is alarmed to alert the operator to the condition. Loss of DC control power, to any relay, from the highly reliable DC power system, will result in loss of relay function.

However, the loss of DC power at the distribution panel supply breaker is alarmed in the control room.

A blackout signal which occurs during the sequence loading following a Safety Injection signal will result in a re-initiation of the sequence loading logic at time step 0 as long as the Safety Injection signal has not been reset, The Kewaunee Emergency Procedures warn the operators that a Blackout Signal occurring after reset of Safety Injection will not actuate the sequence loading and instructs to re-initiate Safety Injection if needed.

(4)USAR section 8.2.3 TS B3.5-3 04/22/2008

BASIS - Safety Limits-Reactor Core (TS 2.1)

The reactor core safety limits shall not be exceeded during steady state operation, normal operational transients, and anticipated operational occurrences. This is accomplished by having a departure from nucleate boiling (DNB) design basis, which corresponds to a 95% probability at a 95% confidence level (that 95/95 DNBR criterion) that DNB will not occur and by requiring that fuel centerline temperature stays below the melting temperature.

The restrictions of the reactor core safety limits prevent overheating of the fuel and cladding as well as possible cladding perforation that would result in the release of fission products to the reactor coolant. Overheating of the fuel is prevented by maintaining the steady state peak linear heat rate (LHR) below the level at which fuel centerline melting occurs. Overheating of the fuel cladding is prevented by restricting fuel operation to within the nucleate boiling regime where the heat transfer coefficient is large and the cladding surface temperature is slightly above the coolant saturation temperature.

Fuel centerline melting occurs when the local LHR, or power peaking, in a region of the fuel is high enough to cause the fuel centerline temperature to reach the melting point of the fuel.

Expansion of the pellet upon centerline melting may cause the pellet to stress the cladding to the point of failure, allowing an uncontrolled release of activity to the reactor coolant.

To maintain the integrity of the fuel cladding and prevent fission product release, it is necessary to prevent overheating of the cladding under all OPERATING conditions. This is accomplished by operating the hot regions of the core within the nucleate boiling regime of heat transfer, wherein the heat transfer coefficient is very large and the clad surface temperature is only a few degrees Fahrenheit above the coolant saturation temperature. The upper boundary of the nucleate boiling regime is termed departure from nucleate boiling (DNB) and at this point there is a sharp reduction of the heat transfer coefficient, which would result in high clad temperatures and the possibility of clad failure. DNB is not, however, an observable parameter during reactor operation. Therefore, the observable parameters of RATED POWER, reactor coolant temperature and pressure have been related to DNB through a DNB correlation. The DNB correlation has been developed to predict the DNB heat flux and the location of the DNB for axially uniform and non-uniform heat flux distributions. The local DNB ratio (DNBR), defined as the ratio of the heat flux that would cause DNB at a particular core location to the local heat flux, is indicative of the margin to DNB. The minimum value of the DNBR, during steady-state operation, normal operational transients, and Condition I and II transients is greater than or equal to the 95/95 DNBR criterion. The 95/95 DNBR criterion corresponds to a 95% probability at a 95% confidence level that DNB will not occur and is chosen as an appropriate margin to DNB for all OPERATING conditions.

The SAFETY LIMIT curves as provided in the Core Operating Report Limits Report show the loci of points of thermal power, reactor coolant system average temperature, and reactor coolant system pressure for which the minimum DNBR is not less than the safety analysis limit, that fuel centerline temperature remains below melting, that the average enthalpy at the exit of the core is less than or equal to the enthalpy of saturated liquid, or that the core exit quality is within limits defined by the DNBR correlation. At low pressures or high temperatures the average enthalpy at the exit of the core reaches saturation before the DNBR ratio reaches the DNBR limit and thus, this limit is conservative with respect to maintaining clad integrity. The area where clad integrity is ensured is below the safety limit curves.

The curves are based on the nuclear hot channel factor limits of as specified in the COLR.

Amendment No. 196 TS B2.1-1 03/28/2008

These limiting hot channel factors are higher than those calculated at full power for the range from all control rods fully withdrawn to maximum allowable control rod insertion. The control rod insertion limits are given in TS 3.1O.d. Slightly higher hot channel factors could occur at lower power levels because additional control rods are in the core. However, the control rod insertion limits as specified in the COLR ensure that the increase in peaking factor is more than offset by the decrease in power level.

The Reactor Control and PROTECTION SYSTEM is designed to prevent any anticipated combination of transient conditions that would result in a DNBR less than the 95/95 DNBR criterion.

Two departure from nucleate boiling ratio (DNBR) correlations are used in the generation and validation of the safety limit curves: the WRB-1 DNBR correlation and the high thermal performance (HTP) DNBR correlation. The WRB-1 correlation applies to the Westinghouse 422 V+ fuel. The HTP correlation applies to FRA-ANP fuel with HTP spacers. The DNBR correlations have been qualified and approved for application to Kewaunee. The DNB correlation limits are 1.14 for the HTP DNBR correlation, and 1.17 for the WRB-1 DNBR correlation. The approved DNBR correlations and methodologies are documented in Section 6.9.

Safety Limit (SL) Violations The following SL violation responses are applicable to the reactor core SLs. If TS 2.1.a, 2.1.b, or 2.1.c is violated, the requirement to go to HOT SHUTDOWN places the unit in a MODE in which this SL is not applicable. The allowed Completion Time of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> recognizes the importance of bringing the unit to a MODE of operation where this SL is not applicable, and reduces the probability of fuel damage.

Amendment No. 196 TS B2.1-2 03/28/2008

BASIS - Reactor Coolant System (TS 3.1.a)

Reactor Coolant Pumps (TS 3.1 .a.1)

When the boron concentration of the Reactor Coolant System is to be reduced, the process must be uniform to prevent sudden reactivity changes in the reactor. Mixing of the reactor coolant will be sufficient to maintain a uniform boron concentration if at least one reactor coolant pump or one residual heat removal pump is running while the change is taking place. The residual heat removal pump will circulate the equivalent of the primary system volume in approximately one-half hour.

Part one of the specification requires that both reactor coolant pumps be OPERATING when the reactor is in power operation to provide core cooling. Planned power operation with one loop out-of-service is not allowed in the present design because the system does not meet the single failure (locked rotor) criteria requirement for this MODE of operation. The flow provided in each case in part one will keep Departure from Nucleate Boiling Ratio (DNBR) well above the DNBR limit.

Therefore, cladding damage and release of fission products to the reactor coolant will not occur.

One pump operation is not permitted except for tests. Upon loss of one pump below 10% full power, the core power shall be reduced to a level below the maximum power determined for zero power testing. Natural circulation-can remove decay heat up to 10% power. Above 10% power, an automatic reactor trip will occur if flow from either pump is lost.(1 )

The RCS will be protected against exceeding the design basis of the Low Temperature Overpressure Protection (LTOP) System by restricting the starting of a Reactor Coolant Pump (RXCP) to when the secondary water temperature of each SG is < 100°F above each RCS cold leg temperature. The restriction on starting a reactor coolant pump (RXCP) when one or more RCS cold leg temperatures is < 2001F is provided to prevent a RCS pressure transient, caused by an energy addition from the secondary system, which could exceed the design basis of the LTOP System.

Decay Heat Removal Capabilities (TS 3.1.a.2)

When the average reactor coolant temperature is < 350°F a combination of the available heat sinks is sufficient to remove the decay heat and provide the necessary redundancy to meet the single failure criterion.

When the average reactor coolant temperature is < 200 0 F, the plant is in a COLD SHUTDOWN condition and there is a negligible amount of sensible heat energy stored in the Reactor Coolant System. Should one residual heat removal train become inoperable under these conditions, the remaining train is capable of removing all of the decay heat being generated.

( 1 USAR Section 7.2.2 Amendment No. 196 TS B3.1-1 03/28/2008

The requirement that the reactor is not to be made critical when the moderator coefficient is greater than the value specified in the COLR has been imposed to prevent any unexpected power excursion during normal operation as a result of either an increase in moderator temperature or a decrease in coolant pressure. The moderator temperature coefficient limits are required to maintain plant operation within the assumptions contained in the USAR analyses. Having an initial moderator temperature coefficient no greater than the value specified in the COLR provides reasonable assurance that the moderator temperature coefficient will be negative at 60% rated thermal power.

The moderator temperature coefficient requirement is waived during low power physics tests to permit measurement of reactor moderator coefficient and other physics design parameters of interest. During physics tests, special OPERATING precautions will be taken. In addition, the strong negative Doppler coefficient(20° and the small integrated Ak/k would limit the magnitude of a power excursion resulting from a reduction in moderator density.

Suitable physics measurements of moderator coefficients of reactivity will be made as part of the startup testing program to verify analytical predictions.

Analysis has shown that maintaining the moderator temperature coefficient at criticality less than or equal to the value specified in the COLR will ensure that a negative coefficient will exist at 60%

power. Current safety analysis supports OPERATING up to 60% power with a moderator temperature coefficient less than or equal to the value specified in the COLR. At power levels greater than 60%, a negative moderator temperature coefficient must exist.

The calculated hot full power (HFP) moderator temperature coefficient will be more negative than the value specified in the COLR for at least 95% of a cycle's time at HFP to ensure the limitations associated with and anticipated transient without scram (ATWS) event are not exceeded. NRC approved methods will be used to determine the lowest expected HFP moderator temperature coefficient for the 5% of HFP cycle time with the highest boron concentration. The cycle time at HFP is the maximum number of days that the cycle could be at HFP based on the design calculation of cycle length. The cycle time at HFP can also be expressed in terms of burnup by converting the maximum number of days at full power to an equivalent burnup. If this HFP moderator temperature coefficient is more negative than the value specified in the COLR, then the ATWS design limit will be met for 95% of the cycle's time at HFP. If this HFP moderator temperature coefficient design limit is still not met after excluding the 5% of the cycle burnup with the highest boron concentration, then the core loading must be revised.

(20) USAR Section 3.2.1 Amendment No. 196 TS B3.1-14 03/28/2008

F,-N(Z) . Heiaht Dependent Nuclear Flux Hot Channel Factor FeN(Z), Height Dependent Nuclear Flux Hot Channel Factor, is defined as the maximum local linear power density in the core at core elevation Z divided by the core average linear power density, assuming nominal fuel rod dimensions.

An upper bound envelope for FaN(Z) as specified in the COLR has been determined from extensive analyses considering all OPERATING maneuvers consistent with the Technical Specifications on power distribution control as given in TS 3.10. The results of the loss-of-coolant accident analyses based on this upper bound envelope indicate the peak clad temperatures, with a high probability, remain less than the 2200OF limit.

The FaN(Z) limits as specified in the COLR are derived from the LOCA analyses.

When a FaN(Z) measurement is taken, both experimental error and manufacturing tolerance must be allowed for. Five percent is the appropriate allowance for a full core map taken with the movable incore detector flux mapping system and 3% is the appropriate allowance for manufacturing tolerance.

FeN(Z) is arbitrarily limited for P < 0.5 (except for low power physics tests).

The measured FaN(Z) is obtained at equilibrium conditions during the target flux determination. The measured FaN(Z) must satisfy the equilibrium and transient relationships that are in the COLR. The FaN(Z) equilibrium relationship is the inequality relationship between F N(Z) and its limit. The FQN(Z) equilibrium relationship does not include the transient condition multiplier.

Because the value of FeN(Z) represents an equilibrium condition, it does not include the variations of FeN(Z) which are present during non-equilibrium situations such as load following or power ascension. To account for these possible variations, the equilibrium value of FeN(Z) is adjusted by an elevation dependent factor that accounts for the calculated worst case transient conditions. Core power distribution is controlled under non-equilibrium conditions by operating the core within the core operating limits on axial flux distribution, quadrant power tilt, and control rod insertion.

The FaN(Z) transient is the measured FaN(Z) obtained at equilibrium conditions multiplied by the elevation dependent factor that accounts for the worst case transient conditions. The FaN(Z) transient relationship is the inequality relationship between the FaN(Z) transient and its limit. The FeN(Z) transient relationship includes the transient condition multiplier.

If a power distribution measurement indicates that the FaN(Z) transient relationship's margin to the limit has decreased since the previous evaluation then TS 3.10.b.6.C provides two options of either increasing the FeN(Z) transient relationship by the appropriate penalty factor or increasing the power distribution surveillance to once every 7 EFPD until two successive flux maps indicate that the FeN(Z) transient relationship's margin to the limit has not decreased. IF FaN(Z) with the penalty factor applied is greater than the limit, then TS 3.10.b.6 is not satisfied and TS 3.10.b.7 should be applied to maintain the normal surveillance interval. Based on TS 3.10.b.7.A, the axial flux distribution (AFD) limits are reduced by 1% for each 1% that the FeN(Z) transient relationship exceeds its limit within the allowed time of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />.

The contingency actions of TS 3.1 O.b.6 and TS 3.1 O.b.7 are to ensure that FQN(Z) does not exceed its limit for any significant period of time without detection. Satisfying limits on FQN(Z) ensures that the safety analyses remain bounding and valid.

Amendment No. 196 TS B3.10-2 03/28/2008

FIHN Nuclear Enthalpy Rise Hot Channel Factor FAHHN, Nuclear Enthalpy Rise Hot Channel Factor, is defined as the ratio of the maximum integral of linear power along a fuel rod to the core average integral fuel rod power.

Itshould be noted that FAHN is based on an integral and is used as such in DNBR calculations. Local heat fluxes are obtained by using hot channel and adjacent channel explicit power shapes which take into account variations in horizontal (x-y) power shapes throughout the core. Thus, the horizontal power shape at the point of maximum heat flux is not necessarily directly related to FAHN.

The FAHN limit is determined from safety analyses of the limiting DNBR transient events. In these analyses, the important operational parameters are selected to minimize DNBR. The results of the safety analyses must demonstrate that minimum DNBR is greater than the DNBR limit for a fuel rod operating at the FAHN limit.

The use of FAHN in TS 3.1 O.b.5.C is to monitor "upburn" which is defined as an increase in FAHN with exposure. Since this is not to be confused with observed changes in peak power resulting from such phenomena as xenon redistribution, control rod movement, power level changes, or changes in the number of instrumented thimbles recorded, an allowance of 2% is used to account for such changes.

Amendment No. 196 TS B3.10-3 03/28/2008

Rod Bow Effects Penalty for rod bow effects is applied based on approved methodology.

Surveillance Measurements of the hot channel factors are required as part of startup physics tests, at least each full power month of operation, and whenever abnormal power distribution conditions require a reduction of core power to a level based on measured hot channel factors. The incore map taken following initial loading provides confirmation of the basic nuclear design bases including proper fuel loading patterns. The periodic monthly incore mapping provides additional assurance that the nuclear design bases remain inviolate and identifies operational anomalies which would otherwise affect these bases.

For normal operation, it is not necessary to measure these quantities. Instead it has been determined that, provided certain conditions are observed, the hot channel factor limits will be met.

These conditions are as follows:

1. Control rods in a single bank move together with no individual rod insertion differing by more than an indicated 12 steps from the bank demand position where reactor power is > 85%, or an indicated 24 steps when reactor power is < 85%.

2. Control rod banks are sequenced with overlapping banks as specified in the COLR.

3. The control bank insertion limits as specified in the COLR are not violated, except as allowed by TS 3.1O.d.2.

4. The axial power distribution, expressed in terms of axial flux difference, is maintained within the limits.

The limits on axial flux difference (AFD) assure that the axial power distribution is maintained such that the FQ(Z) upper bound envelope of FQLIMIT times the normalized axial peaking factor [K(Z)] is not exceeded during either normal operation or in the event of xenon redistribution following power changes. This ensures that the power distributions assumed in the large and small break LOCA analyses will bound those that occur during plant operation.

Provisions for. monitoring the AFD on an automatic basis are derived from the plant process computer through the AFD monitor program. The computer determines the AFD for each of the operable excore channels and provides a computer alarm if the AFD for at least 2 of 4 or 2 of 3 operable excore channels are outside the AFD limits and reactor power is greater than 50 percent or RATED POWER.

For Condition II events the core is protected from overpower and a minimum DNBR less than the DNBR limit by an automatic Protection System. Compliance with the specification is assumed as a precondition for Condition II transients; however, operator error and equipment malfunctions are separately assumed to lead to the cause of the transients considered.

Amendment No. 196 TS B3.10-4 03/28/2008

Inoperable Rod Position Indicator Channels (TS 3.10.f)

The axial position of shutdown rods and control rods are determined by two separate and independent systems: the Bank Demand Position Indication System (commonly called group step counters) and the Individual Rod Position Indication (IRPI) System.

The Bank Demand Position Indication System counts the pulses from the Rod Control System that move the rods. There is one step counter for each group of rods. Individual rods in a group all receive the same signal to move and should, therefore, all be at the same position indicated by the group step counter for that group. The Bank Demand Position Indication System is considered highly precise (+/- 1 step or +/- 5/8 inch). If a rod does not move one step for each demand pulse, the step counter will still count the pulse and incorrectly reflect the position of the rod.

The IRPI System provides an indirect indication of actual control rod position, but at a lower precision than the step counters. The rod position indicator channel is sufficiently accurate to detect a rod +/- 12 steps away from its demand position. If the rod position indicator channel is not OPERABLE, special surveillance of core power tilt indications, using established procedures and relying on movable incore detectors, will be used to verify power distribution symmetry.

A note indicating individual control rod position indications may not be within limits for up to and including one hour following substantial control rod movement modifies this LCO. This allows up to one hour of thermal soak time to allow the control rod drive shaft to reach thermal equilibrium and thus present a consistent position indication. Substantial rod movement is considered to be 10 or more steps in one direction in less than or equal to one hour.

3.10.f.1 When one IRPI channel per group fails, the position of the rod may be determined indirectly by use of the movable incore detectors. The required action may also be satisfied by ensuring at least once per 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> that F0 N(Z) satisfies TS 3.10.b.1.A, TS 3.10.b.5, FAHN satisfies TS 3.10.b.1.B, and SHUTDOWN MARGIN satisfies TS 3.10.a, provided the non-indicating rods have not been moved. Based on experience, normal power operation does not require excessive movement of banks. If a bank has been significantly moved (> 24 steps), the required action of TS 3.1 0.f.3 is required. Therefore, verification of RCCA position within the completion time of 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> is adequate for allowing continued full power operation, since the probability of simultaneously having a rod significantly out of position and an event sensitive to that rod position is small. A reduction of reactor thermal power to < 50% RATED POWER puts the core into a condition where COLR limits are sufficiently relaxed such that rod position will not cause the core to violate COLR limits 1 . The allowed completion time of 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> is reasonable, based on operating experience, for reducing power to < 50% RATED POWER from full power conditions without challenging plant systems and allowing for rod position determination by movable incore detectors.

3.10.f.2 When more than one IRPI per group fail, additional actions are necessary to ensure that acceptable power distribution limits are maintained, minimum SDM is maintained, and the potential effects of rod misalignment on associated accident analyses are limited. Placing the Rod Control System in manual assures unplanned rod motion will not occur. This together with the indirect position determination available via movable incore detectors will minimize the USAR Chapter 14 Amendment No. 196 TS B3.10-7 03/28/2008

potential for rod misalignment. The immediate completion time for placing the Rod Control System in manual reflects the urgency with which unplanned rod motion must be prevented while in this condition. Monitoring and recording reactor coolant Tavg helps assure that significant changes in power distribution and SDM are avoided. The once per hour completion time is acceptable because only minor fluctuations in RCS temperature are expected at steady state plant operating conditions. The position of the rods may be determined indirectly by use of the movable incore detectors. The required action may also be satisfied by ensuring at least once per 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> that FaN(Z) satisfies TS 3.10.b.1.A, TS 3.10.b.5, FAHN satisfies TS 3.10.b.1.B, and SHUTDOWN MARGIN satisfies TS 3.10.a, provided the non-indicating rods have not been moved. Verification of control rod position once per 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> is adequate for allowing continued full power operation for a limited, 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> period, since the probability of simultaneously having a rod significantly out of position and an event sensitive to that rod position is small. The 24-hour.

completion time provides sufficient time to troubleshoot and restore the IRPI system to operation while avoiding the plant challenges associated with the shutdown without full rod position indication.

3.10.f.3 Based on operating experience, normal power operation does not require excessive rod movement. If one or more rods has been significantly moved. When one or more rods with inoperable position indicators have been moved in excess of 24 steps in one direction, since the position was last determined, the required actions of one or more inoperable individual rod position indicators, as applicable, are still appropriate but must be initiated under TS 3.10.f.3 to begin verifying that these rods are still properly positioned, relative to their group positions. If, within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, the rod positions have not been determined, thermal power must be reduced to 50% RATED POWER within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> to avoid undesirable power distributions that could result from continued operation at > 50% RATED POWER, if one or more rods are misaligned by more than 24 steps. The allowed completion time of 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> provides an acceptable period of time to verify the rod positions.

3.10.f.4 With one demand position indicator per bank inoperable, the IRPI System can determine the rod positions. Since normal power operation does not require excessive movement of rods, verification by administrative means (logging IRPI position and verifying within rod alignment limitations) that the rod position indicators are OPERABLE and the most withdrawn rod and the least withdrawn rod are < 12 steps apart when operating at > 85% RATED POWER or < 24 steps apart when operating at < 85% RATED POWER within the allowed Completion Time of once every 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> is adequate. A reduction of reactor thermal power to _<50% RATED POWER puts the core into a condition where COLR limits are sufficiently relaxed such that rod position will not cause the core to violate COLR limits. The allowed completion time of 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> provides an acceptable period of time to verify the rod positions or reduce power to < 50%

RATED POWER.

Inoperable Rod Limitations (TS 3.10.q)

One inoperable control rod is acceptable provided the potential consequences of accidents are not worse than the cases analyzed in the safety analysis report. A 30-day period is provided for the reanalysis of all accidents sensitive to the changed initial condition.

Rod Drop Time (TS 3.10.h)

The required drop time to dashpot entry is consistent with safety analysis.

Amendment No. 196 TS B3.10-8 03/28/2008

BASIS - Refueling Operations (TS 3.8)

The equipment and general procedures to be utilized during REFUELING OPERATIONS are discussed in the USAR. Detailed instructions, the above specified precautions, and the design of the fuel handling equipment incorporating built-in interlocks and safety features, provide assurance that no incident occurs during the REFUELING OPERATIONS that would result in a hazard to public health and safety.(') Whenever changes are not being made in core geometry, one flux monitor is sufficient. This permits maintenance of the instrumentation. Continuous monitoring of radiation levels (TS 3.8.a.2) and neutron flux provides immediate indication of an unsafe condition. The residual heat removal pump is used to maintain a uniform boron concentration.

A minimum shutdown margin of greater than or equal to 5% Ak/k must be maintained in the core. The boron concentration as specified in the COLR is sufficient to ensure an adequate margin of safety. The specification for REFUELING OPERATIONS shutdown margin is based on a dilution during refueling accident.(2) With an initial shutdown margin of 5% Ak/k, under the postulated accident conditions, it will take longer than 30 minutes for the reactor to go critical.

This is ample time for the operator to recognize the audible high count rate signal, and isolate the reactor makeup water system. Periodic checks of refueling water boron concentration ensure that proper shutdown margin is maintained. Specification 3.8.a.6 allows the control room operator to inform the manipulator operator of any impending unsafe condition detected from the main control board indicators during fuel movement.

Interlocks are utilized during REFUELING OPERATIONS to ensure safe handling. Only one assembly at a time can be handled. The fuel handling hoist is dead weight tested prior to use to assure proper crane operation.

The one hundred forty-eight hour decay time following plant shutdown bounds the assumption used in the dose calculation for the fuel handling accident. A cycle-specific cooling analysis will be performed to verify that the spent fuel pool cooling system can maintain the pool temperature within allowable limits based on the one hundred forty-eight hour decay time. In the unlikely event that the analysis determines this time is not sufficient to maintain acceptable pool temperature, the analysis will determine the additional in core hold time required. The requirement for the spent fuel pool sweep system, including charcoal adsorbers, to be operating when spent fuel movement is being made provides added assurance that the off-site doses will be within acceptable limits in the event of a fuel handling accident. The spent fuel pool sweep system is designed to sweep the atmosphere above the refueling pool and release to the Auxiliary Building vent during fuel handling operations. Normally, the charcoal adsorbers are bypassed but for purification operation, the bypass dampers are closed routing the air flow through the charcoal adsorbers. If the dampers do not close tightly, bypass leakage could exist to negate the usefulness of the charcoal adsorber. If the spent fuel pool sweep system is found not to be operating, fuel handling within the Auxiliary Building will be terminated until the system can be restored to the operating condition.

(1)USAR Section 9.5.2 (2)USAR Section 14.1 Amendment No. 200 TS B3.8-1 11/20/2008

Auxiliary Building Special Ventilation System (TS 4.4.d)

Demonstration of the automatic initiation capability is necessary to assure system performance capability.(5)

Pressure drop across the combined HEPA filters and charcoal adsorbers of < 10 inches of water and an individual HEPA bank pressure drop of < 4 inches of water at the system design flow rate

(+/-10%) will indicate that the filters and adsorbers are not clogged by excessive amounts of foreign matter. A test frequency of once per operating cycle establishes system performance capability. This pressure drop is approximately 3 inches of water when the filters are clean.

The frequency of tests and sample analysis are necessary to show that the HEPA filters and charcoal adsorbers can perform as evaluated. Replacement adsorbent should be qualified according to the guidelines of Regulatory Guide 1.52 (Rev. 1) dated July 1976, except that ASTM D3803-89 standard will be used to fulfill the guidelines of Table 2, item 5, "Radioiodine removal efficiency." The charcoal adsorber efficiency test procedures should allow for the removal of one adsorber tray, emptying of one bed from the tray, mixing the adsorbent thoroughly, and obtaining at least two samples. Each sample should be at least two inches in diameter and a length equal to the thickness of the bed. The use of multi-sample assemblies for test samples is an acceptable alternate to mixing one bed for a sample. If the iodine removal efficiency test results are unacceptable, all adsorbent in the system should be replaced. Any HEPA filters found defective should be replaced with filters qualified pursuant to Regulatory Position C.3.d of Regulatory Guide 1.52 (Rev. 1) dated July 1976.

If painting, fire, or chemical release occurs, the charcoal adsorber will be laboratory tested to determine whether it was contaminated from the fumes, chemicals, or foreign materials.

Replacement of the charcoal adsorber can then be evaluated.

In-place testing procedures will be established utilizing applicable sections of ANSI N510-1975 standard as a procedural guideline.

Vacuum Breaker Valves (TS 4.4.e)

The vacuum breaker valves are 18 inch butterfly valves with air to open, spring to close operators.

The valve discs are center pivot and rotate when closing to an EPT base material seat. When closed, the disc is positioned fully on the seat regardless of flow or pressure direction. Testing these valves in a direction opposite to that which would occur post-LOCA verifies leakage rates of both the vacuum breaker valves and the check valves downstream.

(5)USAR Section 9.6 LC000270 TS B4.4-3

Containment Isolation A containment isolation signal is initiated by any signal causing automatic initiation of Safety Injection or may be initiated manually. The containment isolation system provides the means of isolating the various pipes passing through the containment walls as required to prevent the release of radioactivity to the outside environment in the event of a loss-of-coolant accident.

Steam Line Isolation In the event of a steam line break, the steam line isolation valve of the affected line is automatically isolated to prevent continuous, uncontrolled steam release from more than one steam generator.

The steam lines are isolated on Hi-Hi containment pressure or high steam flow in coincidence with Lo-Lo Tavg and Safety Injection or Hi-Hi steam flow in coincidence with Safety Injection. Adequate protection is afforded for breaks inside or outside the containment even under the assumption that the steam line check valves do not function properly.

Isolation Functions

a. Steam Line Isolation - High High Steam Flow Coincident With Safety Injection This Function provides closure of the MSIVs during a steam line break (or inadvertent opening of a relief or safety valve) to maintain at least one non-faulted SG as a heat sink for the reactor, and to limit the mass and energy release to containment.

Two steam flow channels per steam line (loop) are provided. One steam line flow channel per steam line (loop) is required to be OPERABLE for this function. The two steam flow channels per loop are combined in a one-out-of two logic to indicate high steam flow in one steam line. The steam flow transmitters provide control inputs, but the control function cannot cause the events that the Function must protect against. Therefore, two channels are sufficient to satisfy redundancy requirements.

The High-High Steam Flow Setting Limit (TS Table 3.5-1) is a delta pressure (AP), corresponding to approximately 120% of full steam flow at full load steam pressure.

The main steam lines isolate only if the high-high steam flow signal occurs coincident with an SI signal. The Main Steam Line Isolation Function requirements for the SI Functions are as stated in TS Table 3.5-3. Therefore, the requirements are not repeated in Table 3.5-4.

This Function must be OPERABLE in the OPERATING, HOT STANDBY, HOT SHUTDOWN, and INTERMEDIATE SHUTDOWN modes when a secondary side break or stuck open valve could result in rapid depressurization of the steam lines, unless all MSIVs are closed and deactivated, in which case, the Steam Line Isolation channels are not required to be OPERABLE. This Function is not required to be OPERABLE in the COLD SHUTDOWN or REFUELING modes because there is insufficient energy in the secondary side of the unit to have an accident.

b. Steam Line Isolation - High Steam Flow Coincident With Safety Injection and Coincident With Tavg - Low Low This Function provides closure of the MSIVs during a SLB or inadvertent opening of a SG relief or safety valve to maintain at least one non-faulted SG as a heat sink for the reactor, and to limit the mass and energy release to containment.

Amendment No. 202 TS B3.5-2 01/12/2009

Two steam line flow channels per steam line (loop) are provided. One steam line flow channel per steam line (loop) is required OPERABLE for this Function. The two steam flow channels are combined in a one-out-of-two logic to indicate high steam flow in one steam line. The steam flow transmitters provide control inputs, but the control function cannot cause the events that the function must protect against. Therefore, two channels are sufficient to satisfy redundancy requirements.

The one-out-of-two configuration allows online testing because trip of one high steam flow channel is not sufficient to cause initiation.

The High Steam Flow Setting Limit (TS Table 3.5-1) is a A P corresponding to approximately 20% of full steam flow at no load steam pressure.

The main steam line isolates only if the high steam flow signal occurs coincident with an SI and Lo-Lo RCS average temperature. The Main Steam Line Isolation Function requirements for the SI Functions are as stated in TS Table 3.5-3. Therefore, the requirements are not repeated in Table TS 3.5-4.

Two channels of Tavg per loop are provided. One channel of Tavg per loop is required to be OPERABLE. The Tavg channels are combined in a two-out-of-four logic, such that two channels tripped cause a trip for the parameter. The accidents that this Function protects against cause reduction of Tavg in the entire primary system. Therefore, the provision of two OPERABLE channels per loop in a two-out-of-four configuration ensures no single random failure disables the.

Tavg Lo-Lo Function. The Tavg channels provide control inputs, but the control function cannot initiate events that the Function acts to mitigate. Therefore, additional channels are not required to address control protection interaction issues.

This Function must be OPERABLE in the OPERATING, HOT STANDBY, HOT SHUTDOWN, and INTERMEDIATE SHUTDOWN modes, when a secondary side break or a stuck open valve could result in rapid depressurization of the steam lines, unless all MSIVs are closed and deactivated, in which case, the Steam Line Isolation channels are not required to be operable. This Function is not required to be OPERABLE in the COLD SHUTDOWN or REFUELING modes because there is insufficient energy in the secondary side of the unit to have an accident.

c. Steam Line Isolation - Hi-Hi Containment Pressure This Function actuates closure of the MSIVs in the event of a LOCA or a SLB inside containment to maintain at least one non-faulted SG as a heat sink for the reactor, and to limit the mass and energy release to containment. The transmitters (d/p cells) are located outside containment with the sensing line (high pressure side of the transmitter) located inside containment. Hi-Hi Containment Pressure provides no input to any control functions. Thus, three OPERABLE channels are sufficient to satisfy protective requirements with two-out-three logic. The transmitters and electronics are located outside of containment.

Hi-Hi Containment Pressure must be OPERABLE in the OPERATING, HOT STANDBY, HOT SHUTDOWN, and INTERMEDIATE SHUTDOWN modes when there is sufficient energy in the primary and secondary side to pressurize the containment following a pipe break. This would cause a significant increase in the containment pressure, thus allowing detection and closure of the MSIVs.

This Function must be OPERABLE in the OPERATING, HOT STANDY, HOT SHUTDOWN, and INTERMEDIATE SHUTDOWN modes, when a secondary side break or stuck open valve could result in rapid depressurization of the steam lines, unless all MSIVs are closed and deactivated, in which case, the Steam Line Isolation channels are not required to be operable. This Function is not required to be OPERABLE in the COLD SHUTDOWN and REFUELING modes because there is Amendment No. 202 TS B3.5-3 01/12/2009

insufficient energy in the secondary side of the unit to have an accident.

d. Steam Line Isolation - Manual Initiation Manual initiation of Steam Line Isolation can be accomplished from the control room. There are two switches in the control room (a Train A and a Train B switch). Depressing the Main Steam Isolation Initiation Train A or Train B pushbuttons isolates the respective train's MSIV. Depressing both Main Steam Isolation Initiation Initiate pushbuttons is required to immediately close both MSIVs. The specification requires one channel per loop to be OPERABLE when in the OPERATING or HOT STANDBY modes unless all MSIVs are closed and deactivated, in which case, the Steam Line Isolation channels are not required to be operable.

Amendment No. 202 TS B3.5-4 01/12/2009

Main Feedwater Isolation Main feedwater isolation actuation occurs as a result of a Hi-Hi steam generator water level to prevent steam generator overfill conditions. Steam generator overfill may result in damage to secondary components; for example, high moisture steam could erode the turbine blades at an accelerated rate.

Settingq Limits

1. The high containment pressure limit is set at about 10% of the maximum internal pressure.

Initiation of Safety Injection protects against loss-of-coolant(2) or steam line break(3) accidents as discussed in the safety analysis.

2. The Hi-Hi containment pressure limit is set at about 50% of the maximum internal containment pressure for initiation of containment spray and at about 40% for initiation of steam line isolation.

Initiation of containment spray and steam line isolation protects against large loss-of-coolant or steam line break accidents as discussed in the safety analysis.

3. The pressurizer low-pressure limit is set substantially below system operating pressure limits.

However, it is sufficiently high to protect against a loss-of-coolant accident as shown in the safety analysis.

(2)USAR Section 14.3 (3) USAR Section 14.2.5 07/25/2003 TS B3.5-5

4. The steam line low-pressure signal is lead/lag compensated and its setpoint is set well above the pressure expected in the event of a large steam line break accident as shown in the safety analysis.

5. The high steam line flow limit is set at approximately 20% of nominal full-load flow at the no-load pressure and the Hi-Hi steam line flow limit is set at approximately 120% of nominal full-load flow at the full-load pressure in order to protect against large steam line break accidents. The coincident Lo-Lo Tavg setting limit for steam line isolation initiation is set below its HOT SHUTDOWN value. The safety analysis shows that these settings provide protection in the event of a large steam line break.

6. The setpoints and associated ranges for the undervoltage relays have been established to always maintain motor voltages at or above 80% of their nameplate rating, to prevent prolonged operation of motors below 90% of their nameplate rating, and to prevent prolonged operation of 480 V MCC starter contactors at inrush currents.(4) All safeguard motors were designed to accelerate their loads to operating speed with 80% nameplate voltage, but not necessarily within their design temperature rise. Prolonged operation below 90% of nameplate voltage may result in shortening of motor insulation life, but short-term operation below 90% of nameplate voltage will not result in unacceptable effects due to the service factor provided in the motors and the conservative insulation system used on the motors. Prolonged operation of MCC contactors at inrush currents may result in blown control fuses and inoperable equipment; therefore operation will be limited to a time less than it takes for a fuse to blow.

The primary safeguard buses undervoltage trip (84.47% of nominal bus voltage) is designed to protect against a loss of voltage to the safeguard bus and assures that safeguard protection action will proceed as assumed in the USAR. The associated time delay feature prevents inadvertent actuation of the undervoltage relays from voltage dips, while assuring that the diesel generators will reach full capacity before the Safety Injection pump loads are sequenced on.

The safeguard buses second level undervoltage trip (93.8% nominal bus voltage) is designed to protect against prolonged operation below 90% of nameplate voltage of safeguard pumps. The time delay of less than 7.4 seconds ensures that engineered safeguards equipment operates within the time delay assumptions of the accident analyses. The time delay will prevent blown control fuses in 480 V MCC's; the MCC control fuses are the limiting component for long-term low voltage operation. The time delay is long enough to prevent inadvertent actuation of the second level UV relays from voltage dips due to large motor starts (except reactor coolant pump starts with a safeguards bus below 3980 volts). Up to 7.4 seconds of operation of safeguard pumps between 80% and 90% of nameplate voltage is acceptable due to the service factor and conservative insulation designed into the motors.

Each relay in the undervoltage and degraded voltage protection channels will fail safe on loss of AC input power and is alarmed to alert the operator to the condition. Loss of DC control power, to any relay, from the highly reliable DC power system, will result in loss of relay function.

However, the loss of DC power at the distribution panel supply breaker is alarmed in the control room.

A blackout signal which occurs during the sequence loading following a Safety Injection signal will result in a re-initiation of the sequence loading logic at time step 0 as long as the Safety Injection signal has not been reset. The Kewaunee Emergency Procedures warn the operators that a Blackout Signal occurring after reset of Safety Injection will not actuate the sequence loading and instructs to re-initiate Safety Injection if needed.

(4)USAR section 8.2.3 TS B3.5-6 04/22/2008

Instrument OPERATING Conditions During plant OPERATIONS, the complete protective instrumentation systems will normally be in service. Reactor safety is provided by the Reactor Protection Systems, which automatically initiates appropriate action to prevent exceeding established limits. Safety is not compromised, however, by continuing OPERATION with certain instrumentation channels out of service since provisions were made for this in the plant design. This specification outlines LIMITING CONDITIONS FOR OPERATION necessary to preserve the effectiveness of the Reactor Control and PROTECTION SYSTEM when any one or more of the channels is out of service.

Almost all reactor protection channels are supplied with sufficient redundancy to provide the capability for CHANNEL CALIBRATION and test at power. Exceptions are backup channels such as reactor coolant pump breakers. The removal of one trip channel on process control equipment is accomplished by placing that channel bistable in a tripped mode; e.g., a two-out-of-three circuit becomes a one-out-of-two circuit. The source and intermediate range nuclear instrumentation system channels are not intentionally placed in a tripped mode since these are one-out-of-two trips, and the trips are therefore bypassed during testing. Testing does not trip the system unless a trip condition exists in another channel.

The OPERABILITY of the instrumentation noted in Table TS 3.5-6 assures that sufficient information is available on these selected plant parameters to aid the operator in identification of an accident and assessment of plant conditions during and following an accident. In the event the instrumentation noted in Table TS 3.5-6 is not OPERABLE, the operator is given instruction on compensatory actions.

Reactor Trip Permissives/Interlocks(5)

Low Power Reactor Trips Block, P-7 The Low Power Reactor Trips Block, P-7 interlock is actuated by input from the Power Range Neutron Flux, P-1 0, or the Turbine Impulse Pressure, P-1 3, interlock. The P-7 interlock ensures that the following Functions are performed:

(1) on increasing power, the P-7 interlock automatically enables reactor trips on the following Functions:

• Pressurizer Pressure - Low,

• Pressurizer Water Level - High,

• Reactor Coolant Flow - Low (low flow in two RCS loops),

• RCPs Breaker Open (Two Loops),

• Undervoltage RCPs, and

• Underfrequency RCPs.

These reactor trips are only required when operating above the P-7 setpoint (approximately 10% power). The reactor trips provide protection against violating the departure from nucleate boiling ratio (DNBR) limit. Below the P-7 setpoint, the RCS is capable of providing sufficient natural circulation without any RCP running. Prior to exceeding 12.2% rated power these trips must be enabled as required by TS 2.3.a.6.A.

(5) USAR Section 7.4.2 TS B3.5-7 Amendment No. 195 03/28/2008

(2) on decreasing power, the P-7 interlock automatically blocks reactor trips on the following Functions:

" Pressurizer Pressure - Low,

• Pressurizer Water Level - High,

• Reactor Coolant Flow - Low (low flow in two RCS loops),

" RCP Breaker Position (Two Loops),

• Undervoltage RCPs, and

• Underfrequency RCPs.

Trip Setpoint and Allowable Value are not applicable to the P-7 interlock because it is a logic function and thus has no parameter with which to associate a limiting safety system setting (LSSS). The P-7 interlock is a logic function with train and not channel identity. The low power trips are blocked below the P-7 setpoint and unblocked above the P-7 setpoint.

Power Range Neutron Flux, P-8 The Power Range Neutron Flux, P-8 interlock is actuated on increasing power at approximately 10% power as determined by two-out-of-four NIS power range detectors. The P-8 interlock automatically enables the Reactor Coolant Flow - Low and RCP Breaker Position (Single Loop) reactor trips when reactor power increases to above 10% rated power. Enabling the Reactor Coolant Flow - Low and RCP Breaker Position (Single Loop) reactor trips ensures that protection is provided against a loss of flow in one or both RCS loops that could result in DNB conditions in the core when greater than approximately 10% power. On decreasing power, the reactor trips on low flow if any loop is automatically blocked.

Above 10% rated power, a loss of flow in one or both RCS loops could result in DNB conditions.

To prevent a DNB condition from occurring on a loss of flow in one or both RCS loops, the Power Range Neutron Flux, the Reactor Coolant Flow - Low and RCP Breaker Position (Single Loop) reactor trips must be OPERABLE above 10% of rated power. Below 10% of rated power, these trips do not have to be OPERABLE because the core is not producing sufficient power to be concerned about DNB conditions.

Prior to exceeding 10% rated power, these trips must be enabled as required by TS 2.3.a.6.B.

Power Range Neutron Flux, P-10 The Power Range Neutron Flux, P-10 permissive is actuated at approximately 10% power, as determined by two-out-of-four NIS power range detectors. If power level falls below 10% of rated power on 3 of 4 channels, the Power Range High Flux - Low Setpoint and Intermediate Range High Flux nuclear instrument trips will be automatically unblocked. The P-10 permissive ensures that the following Functions are performed:

• On increasing power, the P-1 0 permissive allows the operator to manually block the Intermediate Range Neutron Flux reactor trip. Note that blocking the reactor trip also blocks the signal to prevent automatic and manual rod withdrawal.

• On increasing power, the P-1 0 permissive allows the operator to manually block the Power Range High Flux - Low Setpoint reactor trip.

• On increasing power, the P-10 permissive automatically provides a backup signal to TS B3.5-8 Amendment No. 195 03/28/2008

block the Source Range Neutron Flux reactor trip.

• On decreasing power (3 of 4 NIs less than approximately 10% rated power) the P-10 permissive provides one of the two inputs to the P-7 interlock.

• On decreasing power, the P-10 permissive automatically enables the Power Range High Flux - Low Setpoint reactor trip and the Intermediate Range High Flux reactor trip and rod stop.

Prior to reactor power decreasing below 7.8% rated power, the power range high flux - low setpoint reactor trip and the intermediate range high flux reactor trip must be enabled.

Turbine Impulse Pressure, P-13 The Turbine Impulse Pressure, P-13 interlock is actuated when one-of-two pressure instruments in the first stage of the high-pressure turbine indicates greater than approximately 10% of the rated full power turbine impulse pressure. The P-1 3 interlock provides one of the two inputs to the P-7 interlock. When two-of-two turbine impulse pressure channels indicate less than approximately 10% turbine power, the P-13 interlock is deactivated. When P-13 is deactivated, P-7 is provided with one of the two inputs necessary to block the at-power trips, the other input being P-10.

TS B3.5-9 Amendment No. 195 03/28/2008

BASIS - Auxiliary Electrical Systems (TS 3.7)

The intent of this TS is to provide assurance that at least one external source and one standby source of electrical power is always available to accomplish safe shutdown and containment isolation and to operate required engineered safety features equipment following an accident.

Plant safeguards auxiliary power is normally supplied by two separate external power sources which have multiple off-site network connections (1): the reserve auxiliary transformer from the 138-Kv portion of the plant substation, and a tertiary winding on the substation auto transformer. Either source is sufficient to supply all necessary accident and post-accident load requirements from any one of four available transmission lines.

Each diesel generator is connected to one 4160-V safety features bus and has sufficient capacity to start sequentially and operate the engineered safety features equipment supplied by that bus. The set of safety features equipment items supplied by each bus is, alone, sufficient to maintain adequate cooling of the fuel and to maintain containment pressure within the design value in the event of a loss-of-coolant accident.

Each diesel generator starts automatically upon low voltage on its associated bus, and both diesel generators start in the event of a safety injection signal.(2 J Kewaunee's design basis requires a specified volume of fuel be available at all times. The specified volume must be enough to run a diesel generator for 7 days plus the volume required to conduct one monthly surveillance test. Since Kewaunee does not have a safety related single failure proof method for moving fuel between the Underground Fuel Oil Storage Tanks (UFOSTs), each diesel generator must be aligned to its UFOST with a minimum of 32,888 gallons available to meet the design basis requirement.

A minimum of 7 days fuel supply for each diesel generator is maintained by requiring a useable volume of 32,888 gallons of fuel oil in its associated storage tank and day tanks, thus assuring adequate time to restore off-site power or to replenish fuel. Included in the 32,888 gallons of fuel oil is enough fuel oil for the performance of a monthly surveillance test and to account for the expansion of the fuel oil from the storage tank to the day tanks. Additionally, the required capacity of the day tanks is approximately 4 times the amount needed to maintain at least 60 minutes of operation based on the fuel consumption at a load of 100% of the continuous rating of the diesel plus a minimum margin of 10%. The diesel fuel oil storage capacity requirements are consistent with those specified in ANSI N195-1976/ANS-59.51, Sections 5.2, 5.4, and 6.1. A diesel fuel oil transfer pump is considered operable when it is capable of maintaining the day tanks within the prescribed range during a design bases event.

The plant safeguards 125-V d-c power is normally supplied by two batteries each of which will have a battery charger in service to maintain full charge and to assure adequate power for starting the diesel generators and supplying other emergency loads. A third charger is available to supply either battery.(3)

The arrangement of the auxiliary power sources and equipment and this TS ensure that no single fault condition will deactivate more than one redundant set of safety features equipment items and

( 1) USAR Figure 8.2-1 and 8.2-2 (2)USAR Section 8.2.3 (3) USAR Section 8.2.2 and 8.2.3 TS B3.7-1 Amendment No. 203 02/06/2009

will therefore not result in failure of the plant protection systems to respond adequately to a loss-of-coolant accident.

DG Operability Testing With One Inoperable DG - (TS 3.7.b.2)

TS 3.7.b.2.A provides an allowance to avoid unnecessary testing of the OPERABLE DG. Ifit can be determined that the cause of the inoperable DG does not exist on the OPERABLE DG, SR 4.6.a.1 .A is not required to be performed. If the cause of the operability exists on the OPERABLE DG, the other DG would be declared inoperable upon discovery and TS 3.7.b.7 would be entered. Once the common cause failure is repaired on both DGs, the common cause failure no longer exists, and TS 3.7.b.2 is satisfied. If the cause of the initial inoperable DG cannot be confirmed not to exist on the remaining DG, or it is decided not to pursue a common cause evaluation, performance of SR 4.6.a.1 .A suffices to provide assurance of continued OPERABILITY of the OPERABLE DG. In the event the inoperable DG is restored to OPERABLE status prior to completing either 3.7.b.2.A or 3.7.b.2.B, the corrective action program will continue to evaluate the common cause possibility.

This continued evaluation, however, is no longer under the 24-hour constraint imposed while in TS 3.7.b.2. According to Generic Letter 84-15, 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is a reasonable time frame to confirm that the OPERABLE DG(s) is not affected by the same problem as the inoperable DG.

Operation may continue in TS 3.7.b.2 for a period to not exceed 7 days. In TS 3.7.b.2, the remaining OPERABLE DG and offsite circuits are adequate to supply electrical power to the onsite Class 1E Distribution System. The 7-day completion time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during the period.

Two DGs Inoperable Concurrently For Up To Two Hours - (TS 3.7.b.7)

With Train A and Train B DGs inoperable, there are no remaining standby AC sources. Thus, with an assumed loss of offsite electrical power, insufficient standby AC sources are available to power the minimum required ESF functions. Since the offsite electrical power system is the only source of AC power for this level of degradation, the risk associated with continued operation for a very short time could be less than that associated with an immediate controlled shutdown. Since any inadvertent generator trip could also result in a total loss of offsite AC power, the time allowed for continued operation is severely restricted. The intent here is to avoid the risk associated with an immediate controlled shutdown and to minimize the risk associated with this level of degradation.

According to Regulatory 1.93, with both DGs inoperable, operation may continue for a period that should not exceed 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

TS B3.7-2 Amendment No. 203 02/06/2009

KEWAUNEE POWER STATION TRM 3.7.2 TECHNICAL REQUIREMENTS MANUAL Revision 2 April 7, 2008 3.7.2 COMMON CAUSE TESTING OF EMERGENCY DIESEL GENERATORS Deleted 3.7.2-1

KEWAUNEE POWER STATION TRM 1.0 TECHNICAL REQUIREMENTS MANUAL Revision 5 August 28, 2008 1.0 GENERAL INFORMATION

1. PURPOSE:

The Technical Requirements Manual (TRM) is a Kewaunee Power Station (KPS) controlled document, which supplements the Kewaunee Technical Specifications. The TRM contains requirements similar to the Technical Specifications, which are not required to be located in the Technical Specifications, because they do not meet the requirements of 10 CFR 50.36.

Although these requirements are excluded from Technical Specifications, they are still requirements placed upon plant operation due to regulatory issues. The TRM is considered a part of the Updated Safety Analysis Report (USAR).

2. ORGANIZATION:

Section 2.0 -- REPORTS This section currently contains the Core Operating Limits Report (COLR).

This is a KPS controlled document that provides cycle-specific parameter limits for the current reload cycle. These cycle-specific parameter limits shall be determined for each reload cycle in accordance with Technical Specification Section 6.9.a.4, "Core Operating Limits Report (COLR)," Plant operation within these limits is addressed in the individual specifications.

Other reports may be added to this section as they become available and as deemed appropriate.

Section 3.0 -- ADMINISTRATIVE LIMITING CONDITIONS FOR OPERATION (ALCOs) AND ADMINISTRATIVE SURVEILLANCE REQUIREMENTS (ASRs)

This section contains Administrative (i*e., non-Technical Specification)

Limiting Conditions for Operation and Administrative Surveillance Requirements (designated as ALCOs and ASRs, respectively), in order to distinguish them from Technical Specification requirements.

Specific ALCOs / ASRs will be grouped under the appropriate subsection and sequentially numbered within the subsections.

The ASR is to be performed within the specified surveillance interval, with a maximum allowable extension not to exceed 25% of the specified surveillance interval.

1.0-1

KEWAUNEE POWER STATION TRM 1.0 TECHNICAL REQUIREMENTS MANUAL Revision 5 August 28, 2008 If an ALCO is not met, or if an ASR frequency (including the allowed 25%

extension) is not met, a Condition Report is to be submitted to document the circumstances.

As ALCOs and ASRs become available, they will be inserted into this section.

Section 4.0 -- PROGRAMS The Program Description includes a designation of organizational program ownership, a description of the methodology or basis for establishing acceptance criteria, any associated reporting requirements, content review frequency, and method for determining program effectiveness. Also included will be a description of program implementation and change control. Where appropriate, applicable TS Limiting Conditions for Operation (LCO) and TRM ALCO required actions or other compensatory measures may be noted.

As programs are developed, they may be inserted into this section. There are none at this time.

3. REVISIONS:

Revisions to the TRM will be made in accordance with plant procedures. As part of the USAR, the revisions must comply with the requirements of 10 CFR 50.59.

4. DEFINITIONS:

The definitions given in the KPS Technical Specifications Section 1.0, are to be applied to the appropriate ALCOs and ASRs specified in the TRM.

5.

REFERENCES:

a. KPS Technical Specifications

b. KPS Updated Safety Analysis Report (USAR) 1.0-2

KEWAUNEE POWER STATION TRM 3.5.1 TECHNICAL REQUIREMENTS MANUAL Revision 3 Auqust 28, 2008 3.5.1 CONTAINMENT HYDROGEN MONITORING SYSTEM APPLICABILITY During OPERATING or HOT STANDBY Modes.

OBJECTIVE To monitor the beyond design-basis accident containment air and provide a continuous indication of hydrogen concentration.

TECHNICAL REQUIREMENTS Administrative Limiting Conditions for Operation (ALCOs)

a. Two trains of the Containment Hydrogen Monitoring System and associated Containment Dome Fans shall be functional except as allowed below:

1. One train may be nonfunctional for 30 days.

2. Two trains may be nonfunctional for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

b. If functionality is not restored in the timeframes above, a Condition Report will be initiated immediately to address why the hydrogen monitors were not restored to functional status within the allotted time.

c. A change in operational MODES or conditions is acceptable with one or both trains of the Containment Hydrogen Monitoring System and its associated Containment Dome Vent Fan nonfunctional.

Administrative Surveillance Requirement (ASRs)

CHANNEL CHECK CALIBRATE TEST REMARKS DESCRIPTION I I I Containment Hydrogen Each Monitors Daily refueling Monthly Monitors__ cycle 3.5.1-1

KEWAUNEE POWER STATION TRM 3.5.1 TECHNICAL REQUIREMENTS MANUAL Revision 3 August 28, 2008 BASES The TS requirements for a Containment Hydrogen Monitoring System have been removed from TS as listed in the Federal Register on September 25, 2003. Guidance for the Consolidated Line Item Improvement Process (CLIIP) has been incorporated in the Technical Specification Task Force (TSTF) Change Traveler 447, Rev.1. Part of the requirements for removing Containment Hydrogen Monitoring System from TS was to place any remaining requirements in a Licensee controlled document (Technical Requirements Manual) with the requirements that a hydrogen monitoring system be available for beyond design-basis accident monitoring of containment hydrogen levels.

Even though the requirements for Hydrogen Monitors were taken out of TS, the system still needs to be available for beyond design-basis accident monitoring of containment hydrogen levels. In the event ALCO a.1 or a.2 are not met, a Condition Report will be initiated immediately to address why the hydrogen monitors were not restored to functional status within the allotted time. Actions shall be implemented in a timely manner to place the unit in a safe condition as determined by plant management. The intent of this Condition Report is to utilize the Corrective Action Program to assure prompt attention and adequate management oversight to minimize the additional time the hydrogen monitors are nonfunctional.

The USAR credits the operation of the Containment Dome Vent Fans in section 5.8.2.17. The sample ports are located near the discharge of the Containment Dome Fans, which permit rapid detection of hydrogen escaping from the reactor. The fans draw suction from the upper areas of containment, which prevents the formation of a stratified atmosphere. KPS takes credit for the containment dome vent fans as a support system for the hydrogen monitors. (

Reference:

PORC meeting 97-097, KAP 01-527, Commitment 97-115, and Inspection Report 97-10 IFI 305/97010-01.)

3.5.1-2

KEWAUNEE POWER STATION TRM 3.8.1 TECHNICAL REQUIREMENTS MANUAL Revision 0 January 15, 2009 3.8.1 SPENT FUEL POOL - CONTROL OF HEAVY LOADS APPLICABILITY Whenever a load greater than the weight of a fuel assembly, inclOding its heaviest insert and handling tool, is lifted in or around the spent fuel pool.

OBJECTIVE Control the movement of loads in excess of the nominal weight of a fuel assembly, including its heaviest insert and associated handling tool, in or around the spent fuel pool.

TECHNICAL REQUIREMENTS Administrative Limiting Conditions for Operation (ALCOs)

a. Heavy loads greater than the weight of a fuel assembly, including its heaviest insert and handling tool, will not be transported over or placed in either spent fuel pool when spent fuel is stored in that pool, unless:

1. The heavy load does not traverse directly above spent fuel stored in the pool's spent fuel storage racks, and

2. The load handling system (e.g., crane, associated lifting devices, and interfacing lift points) used for these lifts meets the single-failure-proof handling system criteria.

b. If, during the movement of heavy loads over or in the spent fuel pool, the load handling system is determined not to meet the applicable single-failure-proof criteria, then immediately place the suspended load in a safe condition (no longer suspended over the spent fuel pool) and cease further movement over the spent fuel pool until the crane can be repaired or other appropriate corrective actions implemented to restore compliance.

Administrative Surveillance Requirement (ASRs)

c. The following test shall be performed in the frequency specified

1. None 3.8.1-1

-KEWAUNEE POWER STATION TRM 3.8.1 TECHNICAL REQUIREMENTS MANUAL Revision 0 January 15, 2009 BASES A "heavy load" is defined as any load (a mass or weight suspended from the crane's hook) greater than the weight of a fuel assembly, including its heaviest insert and handling tool. The purpose of this administrative limiting condition for operation is to control the movement of heavy loads in or around the spent fuel pool.

This administrative limiting condition for operations was relocated from the Kewaunee Power Station Technical Specifications because it no longer meets any of the four criteria 10 CFR 50.36 lists for items required in technical specifications.

The Auxiliary Building crane (part of the load handling system1) was modified to meet the criteria of a single-failure-proof crane found in NUREG-0612, Section 5.1.6(2) and the crane is designed, fabricated, installed, and tested to the guidance of NUREG-0554, as approved for KPS. The crane will be inspected, tested, and maintained in accordance with ASME B30.2-1976. In addition, the modified Auxiliary Building crane was load-tested to 156.25 tons (125%). The lifting devices and interfacing lift points associated with the Auxiliary Building crane also meet the guidance in NUREG-0612 to be considered a single-failure-proof lifting system. Specifically, special lifting devices will meet the guidance, in NUREG-0612, Section 5.1.6(1)(a) and lifting devices not specifically designed will meet the guidance in NUREG-0612, Section 5.1.6(1)(b). Interfacing lift points will meet the guidance in NUREG-0612, Section 5.1.6(3). A single-failure-proof AB crane lifting system allows for the removal of the cask-drop accident from the licensing basis of the Kewaunee Power Station, as the accident is no longer credible.

With the cask-drop accident removed from the licensing basis, Criterion 2 of 10 CFR 50.36 no longer applied, and the crane load limits were relocated from the TSs to the TRM.

Crane interlocks are utilized to ensure safe load handling. Crane interlocks and administrative procedures will prevent the movement of heavy loads over spent fuel in the storage racks in spent fuel pool. Movement of necessary heavy loads over irradiated fuel in the spent fuel canister during cask handling operations will only be performed as required by the design of the spent fuel cask system.

Removal/placement of additional spent fuel racks and support hardware will be controlled by procedures to prevent movement to directly above spent fuel. Handling of spent fuel storage casks and associated other heavy loads is controlled by procedures to prevent movement to directly above spent fuel, except as necessary to correctly load the cask system in accordance with the cask vendor's operating procedure.

1 All load bearing components used to life the load, including the crane or hoist, the lifting device, and the interfacing load lift points.

3.8.1-2

KEWAUNEE POWER STATION TRM 3.8.1 TECHNICAL REQUIREMENTS MANUAL Revision 0 January 15, 2009 References

1. License Amendment approving relocation when approved by the NRC.

2. Kewaunee Power Station Updated Safety Analysis Report (USAR) section 9.5, "Fuel Handling System."

3. USAR section 14.2.1, "Fuel Handling Accidents."

4. NUREG 0612, "Control of Heavy Loads at Nuclear Power Plants."

5. Letter from Darrell G. Eisenhut (NRC) to All Licensees of Operating Plants, Applicants for Operating Licenses, and Holders of Construction Permits, "Control of Heavy Loads," dated December 22, 1980.

6. Letter from Darrell G. Eisenhut (NRC) to Licensees, "Control of Heavy Loads (Generic Letter 81-07)," dated February 3, 1981.

7. Letter from Steven A. Varga (NRC) to C.W. Geisler (WPSC), "Control of Heavy Loads (Phase I)," dated March 16, 1984.

8. Letter from C.W. Geisler (WPSC) to D.G. Eisenhut (NRC), "Control of Heavy Loads - Nine-Month Response," dated March 9, 1983.

9. Letter from C.W. Geisler (WPSC) to D.G. Eisenhut (NRC), "Control of Heavy Loads," dated April 4, 1983.

10. Letter from A. Schwencer (NRC) to E.W. James (WPSC), dated March 6, 1979.

(License Amendment 26).

11.52 FR 3788, "Nuclear Regulatory Commission - Proposed Policy Statement on Technical Specification Improvements for Nuclear Power Reactors," dated February 6, 1987.

12.WCAP-11618, "Methodically Engineered, Restructured and Improved, Technical Specifications," dated November 1987.

13. NUREG 0554, "Single-Failure-Proof Cranes for Nuclear Power Plants."

3.8.1-3

KEWAUNEE POWER STATION TRM 3.5.6 TECHNICAL REQUIREMENTS MANUAL Revision 0 January 29. 2009 3.5.6 Emergency Core Cooling System and Containment Spray System Surveillance ALCO 3.5.6 Two Safety Injection (SI), Residual Heat Removal (RHR) and Containment Spray (CS) trains shall be sufficiently full of water to be OPERABLE.

APPLICABILITY: The reactor shall not be made critical unless two SI, RHR and CS trains are OPERABLE, except when performing LOW POWER PHYSICS TESTS.

---

------- NOTE --------------------------------------------

One train may be inoperable for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> for recovery from an inadvertent trip per TS 3.3.b.2 for the SI and RHR systems and TS 3.3.c.1 .A.3 for the CS system.

ACTIONS k jV-F-I-

---

i\IL JI I--........................--------------------

Separate Condition entry is allowed for each SI/RHR train and each CS train.

CONDITION REQUIRED ACTION COMPLETION TIME A. One train of any system A.1 Apply TS 3.3.b.2 for SI system Immediately inoperable.

OR A.2 Apply TS 3.3.b.2 for RHR system.

OR A.3 Apply TS 3.3.c.l.A.3(ii) for CS system.

B. Two trains of any system B.1 Apply TS 3.0.c Immediately inoperable.

---

.-.--..-.- NO TE.- - -- ---

For two inoperable trains of RHR, TS 3.1.a.2 also applies.

3.5.6-1

KEWAUNEE POWER STATION TRM 3.5.6 TECHNICAL REQUIREMENTS MANUAL Revision 0 Januarv 29. 2009 C. Required Action and C.1 Apply TS 3.3.b.2.A. for SI Immediately associated Completion system.

Time of Condition A not met. OR C.2 Apply TS 3.3.b.2.B for RHR system.

OR C.3 Apply TS 3.3.c.1.A.3 for CS system.

SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY ASR 3.5.6.1 Verify SI, RHR and CS piping is sufficiently full of 92 days water.

3.5.6-2

KEWAUNEE POWER STATION TRM 3.5.6 TECHNICAL REQUIREMENTS MANUAL Revision 0 January 29, 2009 BASES BACKGROUND ECCS systems (Safety Injection and Residual Heat Removal) and Containment Spray System The ECCS and CS System pumps are normally in a standby non-operating mode. As such, some flow path piping has the potential to develop pockets of entrained gases. Plant operating experience and analysis has shown that after proper system filling (following maintenance or refueling outages), some entrained non-condensable gases remain. These gases will form small voids, which remain stable in the system in both normal and transient operation. Mechanisms postulated to increase the void size are gradual in nature, and the system is operated in accordance with procedures to preclude growth in these voids.

In addition, other mechanisms, such as valve seat leakage into the stagnant systems from other gas-laden sources, system fluid velocities and physical geometries can cause a gradual increase in the size of gas voids.

The system is sufficiently full of water when the voids and pockets of entrained gases in the ECCS and CS piping are small enough in size and number"to not interfere with the proper operation of the ECCS and CS systems. Verification that the ECCS and CS piping is sufficiently full of water can be performed by venting the necessary accessible high point ECCS and CS vents, using NDE, or using other engineering-justified means.

Maintaining the piping and components from the ECCS pump suction sources to the final isolation valve before connection to the RCS sufficiently full of water ensures that the system will perform properly, injecting its full capacity into the RCS upon demand. This will also prevent pump cavitation and air binding, water hammer, and pumping of excess non-condensable gas (e.g., air, nitrogen, or hydrogen) into the reactor vessel following an SI signal or during shutdown cooling.

One exception to the ECCS system being sufficiently full of water, is the RHR 14" suction line from the B Containment Sump through and including valves SI-350 A&B and SI-351 A&B. Due to concerns regarding pressure locking of these valves, the KPS licensing bases for this line is that it is OPERABLE in an air filled condition.

Maintaining the piping and components from the CS pump suction sources to the discharge to containment sufficiently full of water ensures that the system will perform properly, injecting its full capacity into containment upon demand.

3.5.6-3

KEWAUNEE POWER STATION TRM 3.5.6 TECHNICAL REQUIREMENTS MANUAL Revision 0 Januarv 29. 2009 BASES ALCO and Two SI, RHR and CS trains shall be sufficiently full of water to be APPLICABILITY OPERABLE. The SI, RHR and CS systems (two trains for each system) are required to be OPERABLE when the reactor is critical, except when performing LOW POWER PHYSICS TESTS.

Outside these conditions, the SI, RHR and CS systems are not required to be operable, except as specified in TS 3.1 and TS 3.8. (References 4 and 5).

This ALCO is modified by a Note as stated in TS 3.3.b and TS 3.3.c.1.A.3, that allows one train of SI, RHR and CS to be inoperable for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> during recovery from an inadvertent trip.

ACTIONS The Actions are modified by a Note. The Note provides clarification that each train allows separate entry into a Condition. This is allowed based upon the functional independence of each train. The SI and RHR systems together comprise the ECCS system. These systems work in tandem to provide core cooling and negative reactivity to ensure that the reactor core is protected. Thus, the SI/RHR system consists of two trains and the CS system consists of two trains.

A.1, A.2 and A.3 With one ECCS or CS train inoperable and at least 100% of the ECCS or CS flow is available via the redundant train, the inoperable components must be returned to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The 72-hour Completion Time is based on a reasonable time for repair of many ECCS/CS components and the OPERABILITY of the redundant train. An ECCS train is inoperable if it is not capable of delivering design flow to the RCS. A CS train is inoperable if it is not capable of delivering design flow to containment. Individual components are inoperable if they are not capable of performing their design function or supporting systems are not available.

B._1 Condition B is applicable when two trains of ECCS or CS are inoperable. With two trains of ECCS or CS inoperable, the facility is in a condition outside of the accident analyses. Therefore, LCO 3.0.c must be entered immediately.

This action is modified by a note that alerts the operator to apply the requirements of TS 3.1.a.2 when two inoperable RHR 3.5.6-4

KEWAUNEE POWER STATION TRM 3.5.6 TECHNICAL REQUIREMENTS MANUAL Revision 0 January 29, 2009 BASES systems are present. In this condition, per TS 3.1.a.2.A, when ACTIONS the average RCS temperature descends below 350 0 F, the RHR (continued) system needs to be considered for decay heat removal requirements. In addition, per TS 3.1.a.2.B, both RHR trains need to be restored to OPERABLE status before entering COLD SHUTDOWN mode.

C.1, C.2 and C.3 If the inoperable ECCS or CS train cannot be returned to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the ALCO does not apply. To achieve this status, the following TS sections are invoked to provide for an orderly unit shutdown:

For the SI system, apply TS 3.3.b.2.A.

For the RHR system, apply TS 3.3.b.2.B.

For the CS system, apply TS 3.3.c.l.A.3.

The allowed Completion Times in the TS sections are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE ASR 3.5.6.1 REQUIREMENTS The ECCS and CS System pumps are normally in a standby non-operating mode. As such, some flow path piping has the potential to develop pockets of entrained gases. Plant operating experience and analysis has shown that after proper system filling (following maintenance or refueling outages), some entrained non-condensable gases remain. These gases will form small voids, which remain stable in the system in both normal and transient operation. Mechanisms postulated to increase the void size are gradual in nature, and the system is operated in accordance with procedures to preclude growth in these voids.

In addition, other mechanisms, such as valve seat leakage into the stagnant systems from other gas-laden sources, system fluid velocities and physical geometries can cause a gradual increase in the size of gas voids.

To provide additional assurances that the system will function, verification is performed every 92 days that the system is sufficiently full of water. The system is sufficiently full of water when the voids and pockets of entrained gases in the ECCS and CS piping are small enough in size and number to not interfere with the proper operation of the ECCS and CS systems.

3.5.6-5

KEWAUNEE POWER STATION TRM 3.5.6 TECHNICAL REQUIREMENTS MANUAL Revision 0 January 29. 2009 BASES Verification that the ECCS and CS piping is sufficiently full of SURVEILLANCE water can be performed by venting the necessary accessible REQUIREMENTS high point ECCS and CS vents, using NDE, or using other (continued) Engineering-justified means.

Maintaining the piping and components from the ECCS pump suction sources to the final isolation valve before connection to the RCS sufficiently full of water ensures that the system will perform properly, injecting its full capacity into the RCS upon demand. This will also prevent pump cavitation and air binding, water hammer, and pumping of excess non-condensable gas (e.g., air, nitrogen, or hydrogen) into the reactor vessel following an SI signal or during shutdown cooling. The 92-day frequency takes into consideration the gradual nature of the postulated gas accumulation mechanisms.

One exception to the ECCS system being sufficiently full is the RHR 14" suction line from the B Containment Sump through and including valves SI-350 A&B and SI-351 A&B. Due to concerns regarding pressure locking of these valves, the KPS licensing bases for this line is that it remains in an air filled condition.

Maintaining the piping and components from the CS pump suction sources to the discharge to containment sufficiently full of water ensures that the system will perform properly, injecting its full capacity into containment upon demand. The 92-day frequency takes into consideration the gradual nature of the postulated gas accumulation mechanisms.

REFERENCES 1. USAR 6.2, "Safety Injection System".

2. USAR 6.4, "Internal Containment Spray System".

3. TS 3.3, "Engineered Safety Features and Auxiliary Systems".

4. TS 3.1, "Reactor Coolant System".

5. TS 3.8, "Refueling Operations".

3.5.6-6

KEWAUNEE POWER STATION TRM 3.4.1 TECHNICAL REQUIREMENTS MANUAL Revision 0 February 18. 2009 I I 3.4.1 Turbine Overspeed Protection ALCO 3.4.1 Turbine Overspeed Protection shall be functional with at least two of the following turbine overspeed protection systems:

a. mechanical overspeed trip mechanism,

b. electro-hydraulic control,

c. redundant overspeed trip (ROST) protection.

APPLICABILITY: OPERATING MODE.

ACTIONS

---

NOTE ------------------------------

When one turbine overspeed protection system is non-functional, a second turbine overspeed protection system may be blocked for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> to allow for testing without requiring entry into Condition A, provided at least one system remains functional.

CONDITION REQUIRED ACTION COMPLETION TIME A. Two turbine overspeed A.1 Reduce power to less than 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> protection systems non- 50% rated power.

functional.

B. Three turbine overspeed B.1 Isolate the turbine from the 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> protection systems non- steam supply.

functional.

3.4.1-1

KEWAUNEE POWER STATION TRM 3.4.1 TECHNICAL REQUIREMENTS MANUAL Revision 0 February 18. 2009 SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY TSR 3.4.1.1 Perform turbine redundant overspeed trip test. 31 days TSR 3.4.1.2 Perform turbine trip mechanism test. 92 days TSR 3.4.1.3 Perform turbine mechanical overspeed trip calibration 18 months check.

TSR 3.4.1.4 Perform turbine electro-hydraulic overspeed trip test. 18 months TSR 3.4.1.5 Perform turbine electro-hydraulic overspeed trip 18 months calibration.

TSR 3.4.1.6 Perform redundant overspeed turbine trip system 18 months calibration.

3.4.1-2

KEWAUNEE POWER STATION TRM 3.4.1 TECHNICAL REQUIREMENTS MANUAL Revision 0 Februarv 18. 2009 BASES BACKGROUND The main function of the Turbine Overspeed Protection System is to prevent the generation of potentially damaging missiles from the turbine due to turbine overspeed. The potential effects of missile ejection from the turbine are explained in USAR Section, Appendix B.9, "Turbine Missile Effects" (Reference 1). Turbine overspeed, upon loss of electrical load, is prevented by the rapid cutoff of steam admission to the turbine. Main steam and reheat steam admission are both controlled by series alignments of stop and control valves which are held open against strong spring pressure by high-pressure hydraulic fluid. Overspeed control is by trip-valve release of the hydraulic fluid pressure. Redundant shaft-speed sensors and trip valving systems assure a highly reliable prevention of turbine overspeed.

The E/H Control System contains a turbine shaft speed transducer and is the basic control system for turbine overspeed. At 103 percent of rated shaft speed, this system releases the actuating hydraulic fluid pressure to close the main steam control and intercept valves, which cut turbine steam admission (Reference 2).

In addition to the basic control system for turbine overspeed, there are three backup overspeed protection systems. Each of these three backup overspeed protection systems provides actuation from a source that is independent of the other two overspeed protection systems.

However, actuation of any of the three systems dumps the E/H fluid and therefore initiates closure of all fourteen steam inlet valves.

The first backup overspeed control is supplied by an overspeed trip valve and mechanical overspeed mechanism which consists of a spring-loaded eccentric weight mounted in the end of the turbine shaft.

At a maximum of 109.28% of rated shaft speed, centrifugal force moves the weight outward to mechanically actuate the overspeed trip valve.

The second backup overspeed control is provided by the E/H Control System if the turbine exceeds 109.5% of rated speed by 10 rpm.

For the third feature, the steam supply system has a Redundant Overspeed Trip (ROST) System which provides a completely independent and physically separate redundant sensing and tripping circuit to trip closed all steam supply valves on an overspeed signal derived from three (3) speed pickups. The signals originate from turbine speed-sensing magnetic pickups located in the exciter enclosure.

Overspeed signals are fed to a two out of three (2/3) logic trip relay, which energizes redundant auto stop oil trip solenoid valves. The system actuates if the turbine exceeds 109.5% of rated shaft speed.

Individual channels can be checked on line without loss of the tertiary emergency protective function.

3.4.1-3

KEWAUNEE POWER STATION TRM 3.4.1 TECHNICAL REQUIREMENTS MANUAL Revision 0 Februarv 18. 2009 BASES ALCO and During power operation, Turbine Overspeed Protection is required to be APPLICABILITY functional, including at least two of the following turbine overspeed protection systems: mechanical overspeed trip mechanism; electro-hydraulic control; and, redundant overspeed trip (ROST) protection.

Reactor power shall not exceed 50 percent of rated power unless two of the three turbine overspeed protection systems are functional.

ACTIONS The Required Actions are modified by a Note that allows blocking an individual overspeed protection system for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> to allow for testing (Reference 3). The provisions of this Note are applicable when only one of the turbine overspeed protection systems is non-functional.

One of the remaining two functional systems may be blocked for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> to allow for testing without requiring entry into Condition A.

A.1 If two of the three turbine overspeed protection systems are non-functional, power must be reduced below 50 percent of rated power within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

B.1 If all three turbine overspeed protection systems are non-functional, the turbine overspeed protection systems cannot automatically effect a turbine isolation. This condition requires that the turbine be isolated from its steam supply within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

3.4.1-4

KEWAUNEE POWER STATION TRM 3.4.1 TECHNICAL REQUIREMENTS MANUAL Revision 0 Februarv 18. 2009 BASES SURVEILLANCE Testing of the turbine overspeed protection system is discussed in REQUIREMENTS Reference 3.

TSR 3.4.1.1 TSR 3.4.1.1 requires the performance of a turbine redundant overspeed trip test per Procedure SP-54-233 every 31 days.

TSR 3.4.1.2 TSR 3.4.1.2 requires the performance of a turbine trip mechanism test per Procedure SP-54-063 every 92 days.

TSR 3.4.1.3 TSR 3.4.1.3 requires the performance of a turbine mechanical overspeed trip calibration check per Procedure SP-54-064 every 18 months.

TSR 3.4.1.4 TSR 3.4.1.4 requires the performance of a turbine electro-hydraulic overspeed trip test per Procedure ICP-54-52 every 18 months.

TSR 3.4.1.5 TSR 3.4.1.5 requires the performance of a turbine electro-hydraulic overspeed trip calibration per Procedure ICP-54-52 every 18 months.

TSR 3.4.1.6 TSR 3.4.1.6 requires the performance of a redundant overspeed turbine trip system calibration per Procedure SP-54-234 every 18 months.

REFERENCES 1. USAR Section B.9, Turbine Missile Effects.

2. USAR Section 10.2.2.10, Turbine Overspeed Control.

3. USAR Section 10.4.

3.4.1-5