05000247/LER-2016-005

LER-2016-005, Technical Specification (TS) Prohibited Condition Due to a Surveillance Requirement Never Performed for Testing the Trip of the Main Boiler Feedwater Pumps

Indian Point 2
Event date:	03-26-2016
Report date:	05-25-2016
Reporting criterion:	10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(v), Loss of Safety Function
2472016005R00 - NRC Website

LER 16-005-00 for Indian Point, Unit 2, Regarding Technical Specification (TS) Prohibited Condition Due to a Surveillance Requirement Never Performed for Testing the Trip of the Main Boiler Feedwater Pumps

ML16159A297
Person / Time
Site:	Indian Point
Issue date:	05/25/2016
From:	Coyle L Entergy Nuclear Operations
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
NL-16-056 LER 16-005-00
Download: ML16159A297 (6)

Note: The Energy Industry Identification System Codes are identified within the brackets {}.

DESCRIPTION OF EVENT

On March 26, 2016, during a refueling outage, an NRC inspector identified that the trip of the MBFPs is not tested in accordance with Technical Specification 3.7.3 (Main Feedwater System) Surveillance Requirement (SR) 3.7.3.3. This was discovered as a result of an assessment of the failure of the Main Boiler Feedwater Pumps (MBFPs) steam stop valves to close after the reactor trip on December 5, 2015. TS SR 3.7.3.3 requires testing the MBFP trip function {JK} every 24 months on an actual or simulated actuation signal. Surveillance tests 2-PT-V024DS60 and 2-PT-V24DS61 are performed every 24 months, but only test up to the limit switch contact that actuates the MBFP turbine trip solenoid valves and does not include the trip of the pump {P}. A review determined the requirement to verify the trip of the MBFPs was added to the TS during the implementation of the improved TS (ITS) conversion program but the corresponding testing for MBFP trip was not added to the surveillance tests. The condition was recorded in the Indian Point Energy Center (IPEC) Corrective Action Program (CAP) in Condition Report CR-IP2-2016-02247.

The condition was revealed as a result of the plant trip on December 5, 2015, when the MBFP did not trip remotely or locally, but required manual closure of steam admission valves to trip it. The plant trip was recorded in CR-IP2-2015-05458 noting an unexpected condition where the 21 MBFP HP and LP steam stop valves failed to close and the 21 MBFP startup signal failed to lower from the control room. The cause of the failure of the 21 MBFP to trip was contaminated control oil.

The MBFPs are steam driven pumps single stage, diffuser type, centrifugal pumps with a capacity of approximately 15,300 gpm. Pumps are manufactured by Ingersoll-Rand, type 16 JT. Both MBFPs are driven by a Westinghouse turbine {TRB}. During normal operation, low pressure steam enters through the stop valve bolted to the end of the steam chest.

Steam flow is regulated by positioning of the governor valves within the steam chest.

MBFP turbine control system (J10 consists of an electronic governor, electronic hand speed changer, hydraulically operated governor valve positioner and solenoid operated stop valve controllers. The stop valve control oil pressure opens and closes the stop valves by means of solenoid operated valves 29 and 31 {SOW. Stop valves are provided in the main (high pressure) and reheat (low pressure) steam lines before the high and low pressure governor valves. The stop valves are operated by servomotors which receive control and operating oil from the high pressure oil system. High pressure control oil to the servomotor positioning relay is controlled by the high and low pressure stop valve solenoids. Each stop valve control solenoid when operated manually or electrically by its control push button (open-close from the CR) will open or close its respective valve. When the solenoids open, the high pressure control oil is dumped and the stop valves close.

A historical review of the TS determined the custom TS (CTS) did not include a TS SR to trip test the MBFPs. The inclusion of the TS SR to trip test the MBFPs occurred when the CTS were converted to the Improved TS (ITS) based on NUREG-1431. The TS conversion was conducted as a ITS Project by a contractor which included revising existing procedures and preparing new procedures to address new ITS test requirements. In those cases where the ITS requirements were new procedures they were prepared to address the surveillance requirement. The project initially did not have specific department representatives assigned to support the project and verify the SRs. The department review process had no formal project guidelines or procedures. It is indeterminate why the test of the MBFP was missed during the review/implementation process.

Cause of Event

The direct cause of not testing that the MBFP tripped on an actuation signal was human error for failure to ensure testing Was established to meet new ITS SRs. The apparent cause of the error is indeterminate due to the time passed since TS conversion by Amendment 238 on November 21, 2003. A review determined the requirement to verify the trip of the MBFPs was added to the TS during the implementation of the improved TS (ITS) conversion program but the complete testing to include a MBFP trip was not added to the surveillance tests.

Corrective Actions

The following corrective actions have been or will be performed under Entergy's Corrective Action Program to address the cause and prevent recurrence:

• Surveillance test procedures 2-PT-V024 DS060 and 2-PT-V024 DS061 were revised to trip the MBFPs to satisfy the test surveillance requirement SR 3.7.3.3 of TS 3.7.3.

• Testing of the MBFP actuation function to include pump trip will be performed prior to startup from the outage.

Event Analysis

The event is reportable under 10 CFR 50.73(a)(2)(i)(B). The licensee shall report any operation or condition which was prohibited by the plant's TS. This condition meets the reporting criteria because TS 3.7.3 (Main Feedwater System) requires the two MBFP discharge valves and the trip function to be operable. TS 3.7.3 Condition D (One or both MBFP trips inoperable) required action D.1 is to restore MBFP trip to operable or trip the associated MBFP within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Condition F (Required action and associated completion time not met) required action F.1 is to be in mode 3 in 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and F.2 be in mode 4 in 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The trip function of the MBFP was deemed inoperable because it was determined the TS SR 3.7.3.3 surveillance procedures did not trip the MBFPs to demonstrate operability. Initially the condition appeared to be a missed surveillance. However, review of regulatory action on this issue determined that the condition would not be considered a failure to perform a surveillance within the specified frequency in accordance with SR applicability 3.0.1 which would be a failure to meet the LCO except as provided in SR 3.0.3. Because there was no surveillance to test the trip of the MBFPs, the condition meets the NRC guidance and is being treated as a TS prohibited condition.

There was no safety system functional failure reportable under 10 CFR 50.73(a)(2)(v).

Isolation of the main FW would have been accomplished by closure of the Main FW Regulating Valves (MFRVs), and the closure of all four Low Flow Main FW Bypass Valves (FBVs). In accordance with TS Basis 3.7.3, if all four Main Feedwater Regulating Valves (MFRVs) and all four Low Flow Main Feedwater Bypass Valves (FBVs) close within the time limits that satisfy accident analysis assumptions, main FW isolation to all four steam geherators (SGs) is satisfied. Closure of both MBFP discharge valves which initiates closure of all- eight MFRVs and trip of both MBFPs is a redundancy feature.

In accordance with reporting guidance in NUREG-1022, an additional random single failure need not be assumed in that system during the condition.

Past Similar Events

A review was performed of the past three years of Licensee Event Reports (LERs) for events reporting a TS violation due to inoperable MBFPs trip function. No LERs were identified.

Safety Significance

This event had no effect on the health and safety of the public. There were no actual safety con-sequences for the event because there were no accidents or events during the degraded condition.

Isolation of the main FW system is necessary to mitigate accident and transient conditions [Main Steam Line Breaks (SLB), SG Tube Ruptures, and Excessive Heat Removal Due to FW System Malfunction]. Main FW must be isolated to prevent excessive reactor coolant system cooldown, containment overpressure, and steam line overfill. Main FW isolation is initiated by either an Engineered Safety Feature Actuation System (ESFAS) safety injection (SI) signal or a high steam generator water level signal. Main FW isolation to all four SGs is provided by either 1) Closure of all four main FW regulating valves (MFRVs) and all four Low Flow Main FW Bypass Valves (FBVs), or 2) Closure of both MBFP discharge valves which initiates closure of all eight FW Isolation Valves (MFIVs), and the trip of both MBFPs. Either of these combinations is capable of achieving main FW isolation to all four SGs within the time limits assumed in the accident analysis. If all eight valves referenced in item 1 close, main FW isolation to all four SGs is completed within time limits that satisfy accident analysis assumptions. To establish redundancy for main FW isolation safety function, the SI ESFAS or High SG Level signal also provides a direct signal that closes the two MBFP discharge valves. When both MBFP discharge valves move off the open seat, the relay actuates and generates a signal that initiates closure of the four main FW isolation valves (MFIVs) and the four Low Flow FIVs. For this event, one of the FW isolation capabilities was operable as the post transient report for the reactor trip on December 5,. 2015, recorded FW isolated. This event was bounded by the analyzed event described in FSAR Section 14.1.10, (Excessive Heat Removal Due to Feedwater System Malfunctions).

Excessive FW additions is an analyzed event postulated to occur from a malfunction of the FW control system or an operator error which results in the opening of a FW control valve. The analysis assumes one FW valve opens fully resulting in the excessive FW flow to one SG. For the FW system malfunction at full power, the FW flow resulting from a fully open control valve is terminated by the SG high level signal that closes all FW control valves and trips the MBFPs. The SG high water level signal also produces a signal to trip the main turbine which initiates a reactor trip. The analysis for all cases of the excessive FW addition initiatedat full power conditions with and without automatic rod control, show that the minimum DNBR remains above the applicable safety analysis DNBR limit. In the case of excessive FW flow with the reactor at zero power, the resulting transient is similar to, but less severe than the hypothetical steamline break transient and is bounded by the analysis in UFSAR Section 14.2.5 (Rupture, of a Steam Pipe).