ML101120655

Technical Specifications Bases Changes and Technical Requirements Manual Changes

ML101120655
Person / Time
Site:	Kewaunee
Issue date:	04/14/2010
From:	Wilson M Dominion Energy Kewaunee
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
10-178
Download: ML101120655 (18)

Text

Dominion Energy Kewaunee, Inc.

"D mno N490 Highway 42, Kewaunee, WI 54216-9511 D

APR 14 Z010 ATTN: Document Control Desk Serial No.10-178 U. S. Nuclear Regulatory Commission LIC/NW/RO Washington, DC 20555-0001 Docket No.: 50-305 License No.: DPR-43 DOMINION ENERGY KEWAUNEE, INC.

KEWAUNEE POWER STATION TECHNICAL SPECIFICATIONS BASES CHANGES AND TECHNICAL REQUIREMENTS MANUAL CHANGES Pursuant to Kewaunee Power Station (KPS) Technical Specification 6.21, "Technical Specifications (TS) Bases Control Program," Dominion Energy Kewaunee, Inc. (DEK) hereby submits changes to the TS Bases.

Additionally, DEK submits changes to the KPS Technical Requirements Manual (TRM).

10 CFR 50.71(e)(4) states the requirements for submittal of the KPS Updated Safety Analysis Report (USAR).

As the KPS TRM is considered a part of the USAR by reference, it is also required to be submitted to the Nuclear Regulatory Commission.

The attachments provide copies of the KPS TS Bases and TRM pages reflecting the changes implemented since April 2009. Core Operating Limits Reports (COLR) were submitted as listed below:

COLR, Cycle 29, Revision 2, submitted April 22, 2009 (reference 1)

COLR, Cycle 30, Revision 0, submitted October 6, 2009 (reference 2)

COLR, Cycle 30, Revision 1, submitted October 20, 2009 (reference 3) 0 COLR, Cycle 30, Revision 2, submitted January 19, 2010 (reference 4)

The changes to the TS Bases and TRM were made in accordance with the provisions of 10 CFR 50.59 and approved by the KPS Facility Safety Review Committee.

If you have questions or require additional information, please feel free to contact Mr.

Jack Gadzala at 920-388-8604.

Very truly yours, Michael J. Wilson Director Safety and Licensing A4Do/

Serial No.10-178 Page 2 of 2

References:

1. Letter from Michael J. Wilson (DEK) to Document Control Desk (NRC), "Cycle 29 Revision 2 Core Operating Limits Reports," dated April 22, 2009. (ADAMS Accession No. ML091190310)

2. Letter from Michael J. Wilson (DEK) to Document Control Desk (NRC), "Cycle 30 Core Operating Limits Report," dated October 6, 2009. (ADAMS Accession No. ML092870375)

3. Letter from Michael J. Wilson (DEK) to Document Control Desk (NRC), "Core Operating Limits Report Cycle 30 Revision 1" dated October 20, 2009. (ADAMS Accession No. ML0930001114)

4. Letter from Michael J. Wilson (DEK) to Document Control Desk (NRC), "Core Operating Limits Report Cycle 30 Revision 2" dated January 19,'2010. (ADAMS Accession No. ML100270288)

Attachments:

1. Kewaunee Power Station Technical Specifications Bases Changes

2. Kewaunee Power Station Technical Requirements Manual Changes Commitments made by this letter: NONE cc:

Regional Administrator, Region III U. S. Nuclear Regulatory Commission 2443 Warrenville Road Suite 210 Lisle, IL 60532-4352 Mr. P. S. Tam Sr. Project Manager U.S. Nuclear Regulatory Commission One White Flint North, Mail Stop 08-H4A 11555 Rockville Pike Rockville, MD 20852-2738 NRC Senior Resident Inspector Kewaunee Power Station

Serial No.10-178 ATTACHMENT 1 TECHNICAL SPECIFICATIONS BASES CHANGES AND TECHNICAL REQUIREMENTS MANUAL CHANGES KEWAUNEE POWER STATION TECHNICAL SPECIFICATIONS BASES CHANGES TS BASES PAGES:

TS B3.6-1 TS B3.6-2 TS B3.6-3 TS B4.4-4 TS B3.1-2 TS B3.4-1 TS B3.4-2 TS B3.4-3 (issued 7/28/09)

(issued 7/28/09)

(issued 7/28/09)

(issued 7/28/09)

(issued 9/16/09)

(issued 10/7/09)

(issued 10/7/09)

(issued 10/7/09)

KEWAUNEE POWER STATION DOMINION ENERGY KEWAUNEE, INC.

BASIS Containment System Integrity (TS 3.6.a)

The COLD SHUTDOWN condition precludes any energy releases or buildup of containment pressure from flashing of reactor coolant in the event of a system break. The restriction to fuel that has been irradiated during power operation allows initial testing with an open containment when negligible activity exists. The shutdown margin for the COLD SHUTDOWN condition assures subcriticality with the vessel closed even if the most reactive RCC assembly were inadvertently withdrawn. Therefore, the two parts of TS 3.6.a allow CONTAINMENT SYSTEM INTEGRITY to be violated when a fission product inventory is present only under circumstances that preclude both criticality and release of stored energy.

When the reactor vessel head is removed with the CONTAINMENT SYSTEM INTEGRITY violated, the reactor must not only be in the COLD SHUTDOWN condition, but also in the REFUELING shutdown condition. A 5% shutdown margin is specified for REFUELING conditions to prevent the occurrence of criticality under any circumstances, even when fuel is being moved during REFUELING operations.

This specification also prevents positive insertion of reactivity whenever Containment System integrity is not maintained if such addition would violate the respective shutdown margins.

Effectively, the boron concentration must be maintained at a predicted concentration of 2,200 ppm(1) or more if the Containment System is to be disabled with the reactor pressure vessel open.

Containment Isolation Valves (TS 3.6.b)

Containment isolation valves form a part of the containment boundary. The containment isolation valves' safety function is related to minimizing the loss of reactor coolant inventory and establishing the containment boundary during a DBA.

To be considered OPERABLE, automatic containment isolation valves are required to close within prescribed time limits and to actuate on an automatic isolation signal. Check valves are considered OPERABLE when they have satisfactorily completed their required surveillance testing. Manual isolation components are considered OPERABLE when manual valves are closed, blind flanges are in place, and closed systems are intact.

Penetration flow path(s) may be unisolated intermittently under administrative controls except for the containment purge and vent isolation valves. These administrative controls consist of stationing a dedicated operator at the valve controls, who is in continuous communication with the control room.

In this way, the penetration can be rapidly isolated when a need for containment isolation is indicated.

Due to the size of the containment purge line penetration and the fact that those penetrations exhaust directly from the containment atmosphere to the environment, the penetration flow path containing these valves may not be opened under administrative controls. Specification TS 3.6.b.2 pertains to inoperable valves described in TS 3.6.b.3, manual valves assumed to be closed, and normally closed valves that are not assumed, by the USAR, to automatically close. This allows opening of containment isolation valves without entering the LCO or to open containment isolation valves closed as required by TS, provided the administrative controls are in place to ensure valve closure, if needed.

(1) USAR Table 3.2-1 Amendment No. 206 TS B3.6-1 06/01/2009

Containment Purge and Vent Isolation Valves (36 inch purge valves)

The Containment Purge System operates to supply outside air into the containment for ventilation and cooling or heating and may also be used to reduce the concentration of noble gases within containment prior to and during personnel access. The supply and exhaust lines each contain two isolation valves. Because of their large size, the 36 inch purge valves are not qualified for automatic closure from their open position under DBA conditions.

Therefore, each of the purge valves is required to remain sealed closed when the reactor is greater than Cold Shutdown condition. In this case, the single failure criterion remains applicable to the containment purge valves due to failure in the control circuit associated with each valve. The purge system valve design precludes a single failure from compromising the containment boundary as long as the system is operated in accordance with the Technical Specifications.

For TS 3.6.b.3, separate Condition entry is allowed for each penetration flow path.

This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable containment isolation valve. Complying with the Required Actions may allow for continued operation, and subsequent inoperable containment isolation valves are governed by subsequent Condition entry and application of associated Required Actions.

In the event a containment isolation valve in one or more penetration flow paths is inoperable, the affected penetration flow path must be isolated within the specified time constraints. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are 1) a closed and de-activated automatic containment isolation valve, 2) a closed manual valve, 3) a blind f lange, and 4) a check valve with flow through the valve secured. For a penetration flow path isolated, the device used to isolate the penetration should be the closest available one to containment. The 24-hour completion time is reasonable, considering the time required to isolate the penetration, perform maintenance, and the relative importance of supporting containment OPERABILITY.

For affected containment penetration flow paths that cannot be restored to OPERABLE status within the required completion time and that have been isolated, the affected penetration flow paths must be verified to be isolated on a periodic basis. This is necessary to ensure containment penetrations, requiring isolation following an accident and no longer capable of being automatically isolated, will be in that isolated position should an event occur. This Required Action does not require any testing or device manipulation. Rather, it involves verification, through a system walkdown, that those isolation devices outside containment and capable of being mispositioned are in the correct position.

For the isolation devices inside containment, the time period is specified as "prior to entering INTERMEDIATE SHUTDOWN from COLD SHUTDOWN if not performed within the previous 92 days." This is based on engineering judgment and is considered reasonable in view of the inaccessibility of the isolation devices and other administrative controls that will ensure that isolation device misalignment is an unlikely possibility.

Amendment No. 206 TS B3.6-2 06/01/2009

With two containment isolation valves in one or more penetration flow paths inoperable, the affected penetration flow path must be isolated within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange.

The 1-hour Completion Time is consistent with the ACTIONS of LCO 3.0.c. In the eent the affected penetration is isolated, the affected penetration must be verified to be isolated on a periodic basis which remains in effect. This periodic verification is necessary to assure leak tightness of containment and that penetrations requiring isolation following an accident are isolated. The Completion Time of "once per 31 days for verifying each affected penetration flow path is isolated" is appropriate considering the fact that the valves are operated under administrative control and the probability of their misalignment is low.

For those penetrations where one of the isolation devices is a closed system, either inside containment or outside containment, a longer outage time is allowed.

This condition is only applicable to those penetration flow paths with a single containment isolation valve and a closed system. This longer outage time is due to a closed system subjected to leakage testing, missile protected, and seismic category I piping. Also, a closed system typically has flow through it during normal operation such that any loss of integrity could be observed through leakage detection system inside containment and system walkdowns outside containment. Thus, a 72-hour completion time is considered appropriate given that certain valves may be located inside containment and the reliability of the closed system.

Isolation devices located in high radiation areas shall be verified closed by use of administrative means. Verification by administrative means is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment of these devices once they have been verified to be in the proper position is small.

By removing or interrupting the valves' motive force, activation of an automatic containment isolation valve is precluded. Activation may be prevented by opening the supply breaker for a motor operated valve, isolating air to an air operated valve, removing the supply fuse for a solenoid operated valve, or any other means for ensuring the isolation barrier cannot be affected by a single active failure.

Amendment No. 206 TS B3.6-3 06/01/2009

Isolation Device Positions (TS 4.4.f)

TS 4.4.f.1 ensures each 36 inch containment purge valve is verified sealed closed at 31-day intervals.(6) This Surveillance is designed to ensure that an inadvertent or spurious opening of a containment purge valve does not cause a gross breach of containment. Detailed analysis of the purge valves failed to conclusively demonstrate their ability to close during a LOCA in time to limit off-site doses. Therefore, these valves are required to be in the sealed closed position when the reactor is greater than Cold Shutdown condition. A containment purge valve that is sealed closed must be closed With its control switch sealed in the close position. In-this application, the term "sealed" has no connotation of leak tightness. The frequency is a result of a NRC initiative, Generic Issue B-24, related to containment purge valve use during plant operations.

TS 4.4.f.2 ensures the 2-inch vent/purge valves are closed as required or, if open, open for an allowable reason. If a 2-inch vent/purge valve is open in violation of this TS, the valve is considered inoperable. If the inoperable valve is not otherwise known to have excessive leakage when closed, it is not considered to have leakage outside of limits. The TS is not required to be met when.the 2-inch vent/purge valves are open for the reasons stated. The valves may be opened for pressure control, ALARA, or air quality considerations for personnel entry, or for Surveillances that require the valves to be open. The 2-inch vent/purge valves are capable of closing in the environment following a LOCA. Therefore, these valves are allowed to be open for limited periods of time. The 31 day frequency is consistent with other containment isolation valve requirements discussed.

TS 4.4.f.3.A requires verification that each containment isolation manual valve and blind flange located outside containment and not locked, sealed, or otherwise secured and required to be closed during accident conditions is closed. The TS helps to ensure that post-accident leakage of radioactive fluids or gases outside of the containment boundary are within design limits. This TS does not require any testing or valve manipulation. Rather, it involves verification, through a system walkdown, that those containment isolation valves outside containment and capable of being mispositioned are in the correct position. Since verification of valve position for. containment isolation valves outside containment is relatively easy, the 31 day frequency is based on engineering judgment and was chosen to provide added assurance of the correct positions. The TS specifies that containment isolation valves that are open under administrative controls are not required to meet the TS during the time the valves are open. This TS does not apply to valves that are locked, sealed, or otherwise secured in the closed position, since these were verified to be in the correct position upon locking, sealing, or securing.

(6) Letter from Steven A. Varga (NRC) to C.W. Giesler (WPSC) dated April 22, 1983 Amendment 206 TS B4.4-4 06/01/2009

The requirement for at least one train of residual heat removal when in the REFUELING MODE is to ensure sufficient cooling capacity is available to-remove decay heat and maintain the water in the reactor vessel < 1400 F. The requirement to have two trains of residual heat removal OPERABLE when there is < 23 feet of water above the reactor vessel flange ensures that a single failure will not result in complete loss-of-heat removal capabilities. With the reactor vessel head removed and at least 23 feet of water above the vessel flange, a large heat sink is available. In the event of a failure of the OPERABLE train, additional time is available to initiate alternate core cooling procedures.

Pressurizer Safety Valves (TS 3.1.a.3)

Each of the pressurizer safety valves is designed to relieve 345,000 lbs. per hour of saturated steam at its setpoint. Below 350°F and 350 psig, the Residual Heat Removal System can remove decay heat and thereby control system temperature and pressure. If no residual heat were removed by any of the means available, then the amount of steam which could be generated at safety valve relief pressure would be less than half the valves' capacity. One valve therefore provides adequate protection against overpressurization.

Pressure Isolation Valves (TS 3.1.a.4)

The basis for the pressure isolation valves is discussed in the Reactor Safety Study (RSS),

WASH-1400, and identifies an intersystem loss-of-coolant accident in a PWR which is a significant contributor to risk from core melt accidents (EVENT V). The design examined in the RSS contained two in-series check valves isolating the high pressure Primary Coolant System from the Low Pressure Injection, System (LPIS) piping. The scenario which leads to the EVENT V accident is initiated by the failure of these check valves to function as a pressure isolation barrier. This causes an overpressurization and rupture of the LPIS low, pressure piping which results in a LOCA that bypasses containment.(2)

PORVs and PORV Block Valves ITS 3.1.a.5)

The pressurizer power-operated relief valves (PORVs) operate as part of the normal Pressurizer Pressure Control System. The PORVs are air-operated valves that are controlled to automatically open at a set pressure when the pressurizer pressure increases and to automatically close when the pressurizer pressure decreases. The PORVs are intended to relieve RCS pressure below the setting of the code safety valves, however, the automatic control function is not a requirement of the TS. The PORVs also have the capability to be manually operated from thecontrol room.

Remotely operated block valves are located between the pressurizer and the PORVs.. The block valves provide a positive shutoff capability should a PORV become inoperable in the case of excessive seat leakage or a stuck open PORV. In these cases, block valve closure terminates the RCS depressurization and coolant inventory loss.

The pressurizer PORVs and associated block valves must be OPERABLE to provide an alternate means of mitigating a design basis steam generator tube rupture. Thus, an inoperable PORV (for reasons other than seat leakage) or block valve is not permitted in the HOT STANDBY and OPERATING MODES for periods of more than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

(2) Order for Modification of License dated 4/20/81 09/16/2009 TS B3.1-2

BASIS - Steam and Power Conversion System (TS 3.4)

Main Steam Safety Valves (TS 3.4.a)

The ten main steam safety valves (MSSVs) (five per steam generator) have a total combined rated capability of 7,660,380 lbs./hr. at 1181 lbs./in.2 pressure. This flow ensures that the main steam pressure does not exceed 110 percent of the'steam generator shell-side design pressure (the maximum pressure allowed by ASME B&PV Code) for the worst-case loss-of-sink-event.

While the plant is in the HOT SHUTDOWN condition, at least two main steam safety valves per steam generator are required to be available to provide sufficient relief capacity to protect the system.

The OPERABILITY of the MSSVs is determined by periodic surveillance testing in accordance with the Inservice Testing Plan.

Auxiliary Feedwater System (TS 3.4.b)

The Auxiliary Feedwater (AFW) System is designed to remove decay heat during plant startups, plant shutdowns, and under accident conditions.

During plant startups and shutdowns the system is used in the transition between Residual Heat Removal (RHR) System decay heat removal and Main Feedwater System operation.

The AFW System is considered OPERABLE when the components and flow paths required to provide redundant AFW flow from the AFW pumps to the steam generators are OPERABLE.

This requires that the two motor-driven AFW pumps be OPERABLE, each capable of taking suction from the Service Water System, capable of discharge throttling with AFW-2A or AFW-2B, and supplying AFW to separate steam generators (SGs). The turbine-driven AFW pump is required to be OPERABLE with redundant steam supplies from each of two main steam lines upstream of the main steam isolation valves and shall be capable of taking suction from the Service Water System, capable of discharge throttling with AFW-10A or AFW-10B, and supplying AFW to both of the steam generators. With no AFW trains OPERABLE, immediate action shall be taken to restore a train.

Auxiliary feedwater trains are defined as follows:

"A" train -

"A" motor-driven auxiliary feedwater pump and associated AFW valves and piping to "A" steam generator,,not including AFW-1 OA or AFW-1 OB "B" train -

"B" motor-driven auxiliary feedwater pump and associated AFW valves and piping to "B" steam generator, not including AFW-1 OA or AFW-1 OB Turbine-driven Turbine-driven AFW pump and associated AFW valves and piping to train -

both "A" steam generator and "B" steam generator, including AFW-10A and AFW-1OB LC000350 TS B3.4-1

Two analyses apply to the Loss of Normal Feedwater event:

1. Analysis of the Loss of Normal Feedwater (LONF) event at 1772 MWt.

2. Analysis of the Loss of Normal Feedwater event at 1673 MWt.

One AFW pump provides adequate capacity to mitigate the consequences of the LONF event at 1673 MWt. In the LONF event at 1772 MWt, any two of the three AFW pumps are necessary to provide adequate heat removal capacity.

In the unlikely event of a loss of off-site electrical power to the plant, continued capability of decay heat removal would be ensured by the availability of any single AFW pump, either the steam-driven AFW pump or one of the two motor-driven AFW pumps, and by steam discharge to the atmosphere through the main steam safety valves. Each motor-driven pump and turbine-driven AFW pump is normally aligned to both steam generators.

Valves AFW-10A and AFW-10B are normally open.

As the plant is cooled down, heated up, or operated in a low power condition, AFW.flow will have to be adjusted to maintain an adequate water inventory in the steam generators. This can be accomplished by any one of the following:

1.

Throttling the discharge valves on the motor-driven AFW pumps

2.

Closing one or both of the cross-connect flow valves

3.

Stopping the pumps If the main feedwater pumps are not in operation at the time, valves AFW-2A and AFW-2B must be throttled or the control switches for the AFW pumps located in the control room will have to be placed in the "pull out" position to prevent their continued operation and overfill of the steam generators. The cross-connect flow valves may be closed to specifically direct AFW flow. The placing of the AFW control switches in the "pull out" position, the closing of one or both cross-connect valves, and the closing or throttling of valves AFW-2A and AFW-2B are limited to situations when reactor power is <15% of RATED POWER to provide further margin in the analysis. Manual action to re-initiate flow after it has been isolated is considered acceptable based on analyses. These analyses assume the plant is conservatively higher than 15% initial power and demonstrate that operators have at least 10 minutes to manually initiate AFW during any design basis accident with no steam generator dryout or core damage.

During accident conditions, the AFW System provides three functions:

1.

Prevents thermal cycling of the steam generator tubesheet upon loss of the main feedwater pump

2.

Removes residual heat via the steam generators from the Reactor Coolant System until the temperature drops below 300-350°F and the RHR System is capable of providing the necessary heat sink

3.

Maintains a head of water in the steam generator following a loss-of-coolant accident LC000350 TS B3.4-2

The pumps are capable of automatic starting and can deliver full AFW flow within one minute after the signal for pump actuation. The head generated by the AFW pumps is sufficient to ensure that feedwater can be pumped into the steam generators when the safety valves are discharging and the supply source is at its lowest head.

Analyses show that, for initial power levels below 15%, AFW-2A and AFW-2B may be in the throttled or closed position, or the AFW pump control switches located in the control room may be in the "pull out" position without a compromise to safety. This does not constitute a condition of inoperability as listed in TS 3.4.b.1 or TS 3.4.b.4. The limiting LONF analysis shows that the plant trips before any core damage or system overpressure occurs and that at least 10 minutes are available for the operators to manually initiate auxiliary feedwater flow (start AFW pumps or fully open AFW-2A and AFW-2B).

The OPERABILITY of the AFW System following a main steam line break (MSLB) was reviewed in our response to IE Bulletin 80-04.

As a result of this review, requirements for the turbine-driven AFW pump were added to the Technical Specifications.

In a secondary line break, it is assumed that the pump discharging to the intact steam generator fails and that the flow from the redundant motor-driven AFW pump is discharging out the break. Therefore, to meet single failure criteria, the turbine-driven AFW pump was added to Technical Specifications.

The OPERABILITY of the AFW system following a LONF event was analyzed as part of the stretch power uprate.

As a result of the analysis at 1772 MWt, requirements for three OPERABLE AFW trains prior to increasing power above 1673 MWt were added to the Technical Specifications. In-a LONF event, it is assumed that one of the AFW pumps fails. -Therefore, to meet single failure criteria, all three AFW pumps are required to be OPERABLE prior to increasing power level above 1673 MWt.

For all design basis accidents other than MSLB and the LONF at 1772 MWt,.the two motor-driven AFW pumps supply sufficient redundancy to meet single failure criteria.

The cross-connect valves (AFW-10A and AFW-10B) are normally maintained in-the open position. This provides an added degree of redundancy above what is required for all accidents except for a MSLB.

During a MSLB, one of the cross-connect valves will have to be repositioned regardless if the valves are normally opened or closed. Therefore, the position of the cross-connect valves does not affect the performance of the turbine-driven AFW train.

However, performance of the train is dependent on the ability of the valves to reposition.

Although analyses have demonstrated that operation with the cross-connect valves closed is acceptable, the TS restrict operation with the valves closed to <15% of RATED POWER. At

> 15% RATED.POWER, closure of the cross-connect valves renders the TDAFW train inoperable.

LC000350 TS B3.4-3

Serial No.10-178 ATTACHMENT 2 TECHNICAL SPECIFICATIONS BASES CHANGES AND TECHNICAL REQUIREMENTS MANUAL CHANGES KEWAUNEE POWER STATION TECHNICAL REQUIREMENTS MANUAL CHANGES TRM PAGES:

3.4.1-1 3.4.1-2 3.4.1-3 3.4.1-4 3.4.1-5 3.4.1-6 (issued 3/18/10)

(issued 3/18/10)

(issued 3/18/10)

(issued 3/18/10)

(issued 3/18/1 0)

(issued 3/18/10)

KEWAUNEE POWER STATION DOMINION ENERGY KEWAUNEE, INC.

KEWAUNEE POWER STATION,

TECHNICAL REQUIREMENTS MANUAL TRM 3.4.1 Revision 1 March 18. 2010 3.4.1 Turbine Overspeed Protection ALCO 3.4.1 Turbine Overspeed Protection shall be functional with at least two of the following turbine overspeed protection systems:

a.

mechanical overspeed trip mechanism,

b.

electro-hydraulic control,

c.

redundant overspeed trip (ROST) protection.

APPLICABILITY:

OPERATING MODE.

ACTIONS NOTE When one turbine overspeed protection system is non-functional, a second turbine overspeed protection system may be blocked for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> to allow for testing without requiring entry into Condition A, provided at least one system remains functional.

CONDITION REQUIRED ACTION COMPLETION TIME A.

Two turbine overspeed A.1 Reduce power to less than 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> protection systems non-50% rated power.

functional.

B. Three turbine overspeed B.1 Isolate the turbine from the 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> protection systems non-steam supply.

functional.

3.4.1-1

KEWAUNEE POWER STATION TECHNICAL REQUIREMENTS MANUAL TRM 3.4.1 Revision 1 March 18. 2010 SURVEILLANCE. REQUIREMENTS SURVEILLANCE FREQUENCY TSR 3.4.1.1 Perform turbine redundant overspeed trip test.

31 days TSR 3.4.1.2 Perform turbine trip mechanism test.

92 days TSR 3.4.1.3 Perform turbine mechanical overspeed trip calibration 18 months check.

TSR 3.4.1.4 Perform turbine electro-hydraulic overspeed trip test.

18 months TSR 3.4.1.5 Perform turbine electro-hydraulic overspeed trip 18 months calibration.

TSR 3.4.1.6 Perform redundant overspeed turbine trip system 18 months calibration.

3.4.1-2

KEWAUNEE POWER STATION TRM 3.4.1 TECHNICAL REQUIREMENTS MANUAL Revision 1 March 18, 2010 BASES BACKGROUND The main function of the Turbine Overspeed Protection System.is to prevent the generation of potentially damaging missiles from the turbine due to turbine overspeed. The potential effects of missile ejection from the turbine are explained in USAR Section, Appendix B.9, "Turbine Missile Effects" (Reference 1).

Turbine overspeed, upon loss of electrical load, is prevented by the rapid cutoff of steam admission to the turbine. Turbine main and reheat steam admission are both controlled by series alignment of main turbine stop, control, reheat, and intercept valves which are held open against strong spring pressure by high-pressure hydraulic fluid.

Overspeed control and protection is by release of hydraulic fluid pressure to the steam admission valves. Three independent overspeed protection systems and redundant hydraulic fluid pressure release valves assure a highly reliable prevention of turbine overspeed.

The E/H Control System incorporates an Overspeed Protection Controller to limit the overspeed of the turbine during a loss of electrical load. A turbine shaft speed transducer provides a signal to the E/H Control System and at 103 percent of rated shaft speed, this system releases the actuating hydraulic fluid pressure to close the control and intercept valves (Reference 2). Once speed is reduced, the main turbine control and intercept valves reopen allowing the E/H Control System to return the turbine generator to 1800 rpm.

The main overspeed protection system is the mechanical overspeed trip mechanism which is backed up by two separate overspeed protection systems. However, actuation of any of the three systems dumps the E/H fluid and therefore initiates closure of all fourteen steam inlet valves. In addition to closing the steam inlet valves, dumping E/H fluid also closes the air pilot valve to the extraction line non-return valves to Feedwater Heaters No. 14 and 15, thereby closing the non-return valves. Baffles in Feedwater Heaters No. 11, 12, and 13 minimize flashback of water in these heaters. Even though the 14 steam inlet valves and the extraction line non-return valves are relied upon for overspeed protection, a Westinghouse analysis (WCAP-11525, "Probabilistic Evaluation of Reduction in Turbine Valve Test Frequency" and WCAP-16054-P, "Probabilistic Analysis of Reduction in Turbine Valve Test Frequency for Nuclear Plants with Siemens-Westinghouse BB-95/96 Turbines," determined certain valve failures would not result in a design overspeed situation.

The main overspeed protection system consists of an overspeed oil trip valve and a mechanical overspeed mechanism which consists of a spring-loaded eccentric weight mounted in the end of the turbine shaft.

3.4.1-3

KEWAUNEE POWER STATION TRM 3.4.1 TECHNICAL REQUIREMENTS MANUAL Revision 1 March 18, 2010 BASES BACKGROUND At a maximum of 109.28 percent of rated shaft speed, centrifugal force (continued) moves the weight outward to mechanically actuate the overspeed trip valve which dumps auto stop oil pressure and-in turn releases the actuating hydraulic fluid pressure to close the main turbine stop, control, reheat stop, and intercept valves. The supply steam pressure acts to hold the main turbine stopvalves closed.

One of the backup overspeed protection systems is provided by the E/H Control System if turbine speed reaches 109.5 percent of rated speed.

At this point, the solenoid trip is energized to dump the auto stop oil which releases actuating hydraulic fluid pressure to ensure closing of the main turbine stop, control, reheat stop, and intercept valves.

Another backup overspeed protection system is the Redundant Channel Overspeed Trip System (ROST). This system provides a completely independent and physically separate redundant sensing and tripping circuit to trip closed all steam supply valves at 109.5 percent of rated speed. Speed signals originate from three turbine speed-sensing magnetic pickups located in the exciter enclosure. The three pickups provide a signal to three speed switches each containing frequency converters, comparators, and trip relays. The unit works by comparing the signals from the frequency converters to the overspeed trip setpoint.

An overspeed trip signal is generated by 2 out of 3 (2/3) relay trip, logic which energizes redundant auto stop oil trip solenoids. When energized, the redundant auto stop oil trip devices release auto stop oil pressure which releases E/H fluid system pressure on the valve actuators of the main turbine stop, control, reheat stop, and intercept valves, allowing the heavy spring pressure to slam the valves closed.

Power for the magnetic speed pickups, frequency converters and comparators is provided by the exciter's permanent magnet generator.

Power for the trip relays is provided by 125 VDC battery BRC-101 and power for the redundant auto stop oil solenoids is-provided by 125VDC battery BRA-101. Individual channels can be checked on line without loss of the emergency protective function.

3.4.1-4

KEWAUNEE POWER STATION TECHNICAL REQUIREMENTS MANUAL TRM 3.4.1 Revision 1 March 18. 2010 BASES ALCO and During power operation, Turbine Overspeed Protection is required to be APPLICABILITY functional, including at least two of the following turbine overspeed protection systems: mechanical overspeed trip mechanism; electro-hydraulic control; and, redundant overspeed trip (ROST) protection.

Reactor power shall not exceed 50 percent of rated power unless two of the three turbine overspeed protection systems are functional.

ACTIONS The Required Actions are modified by a Note that allows blocking an individual overspeed protection system for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> to allow for testing (Reference 3). The provisions of this Note are applicable when only one of the turbine overspeed protection systems is non-functional.

One of the remaining two functional systems may be blocked for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> to allow for testing without requiring entry into Condition A.

A.1 If two of the three turbine overspeed protection systems are non-functional, power must be reduced below 50 percent of rated power within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

B.. 1 If all three turbine overspeed protection systems are non-functional, the turbine overspeed protection systems cannot automatically effect a turbine isolation. This condition requires that the turbine be isolated fromits steam supply within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

3.4.1-5

KEWAUNEE POWER STATION TECHNICAL REQUIREMENTS MANUAL TRM 3.4.1 Revision 1 March 18. 2010 BASES SURVEILLANCE Testing of the turbine overspeed protection system is discussed in REQUIREMENTS Reference 3.

TSR 3.4.1.1 TSR 3.4.1.1.requires the performance of a turbine redundant overspeed trip test every 31 days.

TSR 3.4.1.2 TSR 3.4.1.2 requires the performance of a turbine trip mechanism test every 92 days.

TSR 3.4.1.3 TSR 3.4.1.3 requires the performance of a turbine mechanical overspeed trip calibration check every 18 months.

TSR 3.4.1.4 TSR 3.4.1.4 requires the performance of a turbine electro-hydraulic overspeed trip test every 18 months.

TSR 3.4.1.5.

TSR 3.4.1.5 requires the performance of a turbine electro-hydraulic overspeed trip calibration every 18 months.

TSR 3.4.1.6 TSR 3.4.1.6 requires the performance of a redundant overspeed turbine trip system calibration every 18 months.

REFERENCES

1. USAR Section B.9, Turbine Missile Effects.

2. USAR Section 10.2.2.10, Turbine Overspeed Control.

3. USAR Section 10.4.

.. I 3.4.1-6