05000390/LER-2015-006, Regarding Source Range Level Trip Channels (N-31 and N-32) Inoperable During Plant Startup

Regarding Source Range Level Trip Channels (N-31 and N-32) Inoperable During Plant Startup

ML15355A525
Person / Time
Site:	Watts Bar
Issue date:	12/21/2015
From:	Walsh K Tennessee Valley Authority
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
LER 15-006-00
Download: ML15355A525 (10)

LER-2015-006, Regarding Source Range Level Trip Channels (N-31 and N-32) Inoperable During Plant Startup

Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor
3902015006R00 - NRC Website

text

Tennessee Valley Authority, Post Office Box 2000, Spring City, Tennessee 37381 December 21,2015 10 cFR 50.73 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, D.C. 20555-0001 Watts Bar Nuclear Plant, Unit 1 Facility Operating License No. NPF-90 NRC Docket No. 50-390 Subject: Licensee Event Report 39012015-006-00, Source Range Level Trip Channels (N-3{ and N2) lnoperable During Plant Startup This submittal provides Licensee Event Report (LER) 390/2015-006-00. This LER provides details concerning failure to follow the required actions of Technical Specification 3.3.1, Table 3.3.1-1, Function 5. This report is being submitted in accordance with 10 CFR 50.73(aX2XiXB) and 50.73(aX2XvXA).

Please direct any questions concerning this matter to Gordon Arent, WBN Licensing Director, at (423) 365-2004.

wJ Kevin T. Walsh Site Vice President Watts Bar Nuclear Plant Enclosure cc: See Page 2

U.S. Nuclear Regulatory Commission Page 2 December 21,2015 cc (Enclosure):

NRC RegionalAdministrator - Region ll NRC Senior Resident lnspector - Watts Bar Nuclear Plant, Unit 1 NRC Project Manager - Watts Bar Nuclear Plant, Unit 1

NRC FORM 366 U.S. NUCLEAR REGULATORY GOMMISSION (02-2014\\

-.f*'*?,

q'\\ nf i

i.ffitrj!

%.X;f LICENSEE EVENT REPORT (LER)

oiE,i'1n""""l1:[H[:#fii;[,"'

APPROVED BY OMB: NO. 3150-0104 EXPIRES: 01131t2A17 Estimated burden per response to comply with this mandatory collection request 80 hours9.259259e-4 days <br />0.0222 hours <br />1.322751e-4 weeks <br />3.044e-5 months <br />.

Reported lessons learned are incorporated into the licensing process and fed back to industy.

Send commenF regarding burden estimate to the FOIA, Privacy and lnformation Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 2055S0001, or by internet e-mail to lnfocollects.Resource@nrc,gov, and to the Desk Officer, ffice of lnbrmation and Regulatory Afiairs, NE0B-10202, (3150-0104), Offce of Management and Budget, Washington, DC 20503. lf a means used to impose an information collection does not display a curren0y valid OMB contol number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

1. FACILITY NAME Watts Bar Nuclear Plant, Unit 1

2. DOCKET NUMBER 05000390

3. PAGE 10F8

4. TITLE Source Range LevelTrip Channels (N-31 and N-32) lnoperable During Plant Startup

5. EVENT DATE

6. LER NUMBER

7. REPORT DATE

8. OTHER FACILITIES INVOLVED MONTHI DAY I YEAR YEAR I t=rtr=HsL REV NO.

MONTH I DAY YEAR FACILIW NAME NA DOCKET NUMBER NA 19 I 2015 10 2015 - 006 r 00 12 21 2015 FACILITY NAME NA DOCKET NUMBER NA

9. OPERATING tt'IODE I I. THIS REPORT lS SUBMITTED PURSUANT TO THE REQUIRE[f,ENTS OF 10 CFR $: (Ch*k att that apply) 3 tr 2o.z2o1(b) tr zo.22os(aX3Xi) tl s0.73(aX2XiXc) tr so.7g(aX2Xvii) n 20.2201(d) tr 20.2203(aX3Xii) tr 50.73(aX2Xii)(A) tr s0.73(aX2XviiiXA) tr 20.2203(aX1) tr 20.2203(aX4) tr 50.73(aX2XiiXB) tr 50.73(aX2XviiiXB) tr zo.2zos(aX2Xi) tr 50.36(cxl XIXA) tr s0.73(ax2)(iii) tr s0.73(aX2XixXA)

10. POWER LEVEL 0o/o tl 20.2zo3(aX2)(ii) n 50.36(cX1)(iiXA) n 50.73(aX2X.v)(A) tr s0.73(aX2Xx) tr 2o.2zos(aX2Xii.)

tr s0.36(cX2)

X 50.73(aX2Xv)(A) tr n.T1(aX4) tr 2o.z2os(a)(2)(iv) tl 50.46(aX3Xi.)

tr 50.73(a)(2XvXB) tr rcl1(aXs) tr 2o.22os(aX2Xv) tl s0.73(aX2XiXA) n 50.73(aX2XvXc) tr orHER tr zo.22os(aX2Xvi) tr 50.73(aX2XiXB) tl 50.73(a)(2XvXD)

Specify in Abstract below or in

I.

PLANT OPERATING CONDITIONS BEFORE THE EVENT

Watts Bar Nuclear Plant (WBN) Unit 1 was in Mode 3 with two Source Range (SR) channels providing flux indication and alarms, SR leveltrip channels bypassed, and the reactor trip breakers (RTBs) [EllS:BKR]open.

II.

DESCRIPTION OF EVENT

A. Event On October 7,2015, at'1414 Eastern Daylight Time (EDT) prior to core reload during the Cycle 13 Refueling Outage, the level trip switches [EllS:lG] for the SR Level Trip Channels (N-31 and N-32) were placed in the bypass position in accordance with Power Escalation Test Procedure 1-PET-105 Revision 3.

The SR leveltrip switches are placed in the bypass position to avoid potential SR trips and alarms during core alterations. Core reload was completed on October 9, 2015 at approximately 1830 EDT with the SR level trip switches remaining in the bypass position. At this point, the SR level trip switches should have been placed back to the normal position; however, Revision '1 of 1-PET-105, dated July 19, 2013, had inadvertently omitted the step. The SR leveltrip switches are located on the SR drawers on panel 1-M-13 in the main control room (MCR) and are primarily used to test, calibrate or place a failed instrument channel in bypass.

On October 19,2015, at2139 EDT, with the plant in Mode 3 the RTBs were closed to accommodate control rod testing. This action resulted in a specified condition entry violation in accordance with Technical Specifications (TS) Limiting Condition for Operation (LCO) 3.0.4 and a violation of TS 3.3.1, Table 3.3.1-1, Function 5 because two SR level trip channels were inoperable with the RTBs closed and the Rod Control System [ElIS:AA] capable of rod withdrawal. Under these conditions, TS 3.3.1, Required Actions A.1 and J.1, required that the operators take immediate actions to open the RTBs. This action was not performed because the operators were not aware of the position of the SR level trip switches at the time the RTBs were closed.

On October 21,2015 at 0346 EDT, the plant entered Mode 2 with both SR level trip channels inoperable.

This was a mode change violation in accordance with LCO 3.0.4. Under these conditions, TS 3.3.1, Required Actions 4.1, 1.1 and J.1, required that the operators take immediate actions to suspend operations involving positive reactivity additions and open the RTBs. On October 21,2015 at 0623 EDT, reactor power was increased above the P permissive interlock and the SR high flux trip signals were then blocked using General Operating lnstruction (1-GO-2), "Reactor Startup," at approximately 0625 EDT. The SR leveltrip channels are required to be blocked above P to avoid reactor trip during power ascension.

On October 21,2015 at 1749 EDT, the plant entered Mode 1. On October 22,2015, at approximately 1000 EDT the operating staff discovered that the SR level trip switches were in the bypass position. At the time of discovery the plant was in Mode 1 at27 percent RTP. Following discovery, the SR level trip switches were restored to their normal position on October 22,2015, at 1258 EDT. At the time of discovery there were no TS applicability requirements for the SR high flux trip function because reactor power was above the P6 permissive interlock. The required TS were not met between October 19,2015, at2139 EDT and October 21,2015, at 0623 EDT. As a result, this condition is reportable in accordance with 10 CFR 50.73(a)(2)(v)(A), "Any event or condition that could have prevented the fulfillment of the safe$ function of structures or systems that are needed to shut down the reactor and maintain it in a safe shutdown condition," and 10 CFR 50.73(aX2Xi)(B), "Any operation or condition which was prohibited by the plant's Technical Specifications."

B.

lnoperable Structures, Components, or Systems that Contributed to the Event No inoperable structures, components, or systems contributed to this event.

C. Dates and Approximate Times of Occurrences

Date Time (EDT)

Event 10t07 t2015 1414 SR level trip switches located at the SR drawers placed in the Bypass position prior to core reload in accordance with 1-PET-105. This action caused the SR leveltrip channels (N31 and N32) to be inoperable.

10t09t2015 1 830 Core reload completed without properly restoring SR level trip switches to Normal position.

10t18t2015 1 500 Entered Mode 3.

10t19t2015 2139 Closed RTBs with both SR level trip channels inoperable (specified condition entry violation per TS LCO 3.0.4 and TS 3.3.1 Required Actions A.1 and J.1).

10t21t2015 0346 Entered Mode 2 (specified condition entry violation per TS LCO 3.0.4 and TS 3.3.1 Required Actions A.'l, 1.1, and J.1).

10t21t2015 0623 Intermediate Range power exceeded P-6 permissive interlock.

10t21t2015 0625 SR level trip channels blocked in accordance with 1-GO-Z at main control board (TS 3.3.1 Function 5 no lonser applicable).

10t21t2015 1749 Entered Mode 1.

10t22t2015 1 000 Reactor at 27 percent RTP, operator discovered both SR level trip switches in the Bypassed position.

10t22t2015 1258 SR level trip switches for both trip channels (N31 and N32) placed in the Normal position.

D. Manufacturer and Model Number of Components that Failed There were no failed components associated with this event.

E. Other Systems or Secondary Functions Affected

There were no systems or secondary functions affected by this event.

F. Method of discovery of each Component or System Failure or Procedural Error

Review of Control Board annunciators was the initial method for discovery of the mis-positioned switches.

G. Failure Mode and Effect of Each Failed Component There were no component failures associated with this event.

H. Operator Actions

Upon discovery of the inoperable SR high flux trip function, operations personnel documented the condition in the Corrective Action Program as Condition Report (CR) 1096405, evaluated plant status and returned the SR leveltrip switches to the Normal position.

l. Automatically and Manually lnitiated Safety System Responses

There was no automatic or manualsystem responses associated with this event.

III.

CAUSE OF THE EVENT

A. The cause of each component or system failure or personnel error, if known.

There were no component or system failures as a result of this event notification. The SR level trip channels were inoperable due to human performance error and inadequate startup procedures.

B. The cause(s) and circumstances for each human performance related root cause.

The root cause was that the operators failed to identify a bypassed safety function during reactor testing and start-up due to inadequate tracking and validation of essential information. A contributing cause was inadequate operating procedures used to control SR level trip switches prior to core reload.

IV. ANALYSIS OF THE EVENT

The SR level trip channels and associated alarms are designed to provide core protection for the following Condition ll and lV events.

a. boron dilution event during startup (Condition ll),

b. uncontrolled rod bank withdrawal from subcritical conditions (Condition ll), and c. rod ejection accident at hot zero power (Condition lV).

For Mode 6 Chapter 15 of the Updated Final Safety Analysis Report (UFSAR) credits administrative controls to preclude boron dilution events by isolating the RCS from potential sources of un-borated water. Although the UFSAR does not assume a boron dilution event in Mode 6, the SR Audio Count Rate and the High Flux at Shutdown Alarm were available in accordance with TS LCO 3.9.3, Nuclear lnstrumentation, to provide containment evacuation and to alert the operators to a potential boron dilution event or an improperly loaded fuel assembly. ln addition, uncontrolled rod bank withdrawal from subcritical conditions or a rod ejection accident were not creditable in Mode 6 because the Control Rod Drive Mechanisms (CRDMS) were unlatched from the Rod Cluster Control Assembly (RCCAS) and the reactor vessel head was either removed or the closure bolts were de-tensioned preventing any pressure buildup.

For Modes 3, 4, and 5, with the RTBs open, TS LCO 3.3.1, Table 3.3.1-1, Function 5, requires that one SR channel be operable to monitor core neutron flux levels and provide visual indication and audible alarm of reactivity changes that may occur as a result of a boron dilution event. For a boron dilution event, UFSAR Table 15.2-1 credits the alarms associated with the SR level trip channels as the primary means to alert the operator that a boron dilution accident is in progress. For this event the operator has more than 15 minutes to terminate the event using the ChemicalVolume Control System (CVCS) [EllS:CB] or the Emergency Core Cooling Systems (ECCS) [EllS:BQ] to borate the reactor coolant system (RCS) [ElIS:AB] before a loss of Shutdown Margin (SDM) occurs. The safety functions to monitor core reactivity for the above modes were met with two SR monitoring channels operable (see Section V.A for list of operable SR instrumentation). Core protection for an uncontrolled rod bank withdrawal from subcritical conditions and a potential rod ejection accident at hot zero power were met with the RTBs open.

For Mode 2 (below P), and Modes 3, 4, and 5, with the RTBs closed and the Rod Control System [EllS:AA]

capable of rod withdrawal, TS LCO 3.3.1, Table 3.3.1-1, Function 5, requires that two SR level trip channels be operable to provide core protection for a boron dilution event, uncontrolled rod bank withdrawal from subcritical conditions or a rod ejection accident. Two operable SR level trip channels ensure that no single random failure willdisable the SR trip function. These safety functions were not met in Mode 3 because the SR leveltrip channels were bypassed with the RTBs closed.

Above the P6 permissive interlock, the intermediate and power range trip channels provide core protection for allCondition ll, llland lV Events.

Because the SR leveltrip channels were inoperable in Mode 3 with the RTBs closed below the P.6 permissive interlock, the above safety functions were not satisfied. The potentialconsequences of not meeting TS LCO 3.3.1 are given in the following sections.

V.

ASSESSMENT OF SAFETY CONSEQUENCES

A. Availability of systems or components that could have performed the same function as the components and systems that failed during the event.

ln Modes 3, 4, and 5, with the RTBs open, the following SR instrumentations and alarms were available to alert the operator of a potential boron dilution event:

1. SR Neutron Flux Meters calibrated logarithmically from 1 to 10E6 counts per second (cps).

2. SR Neutron Flux Recorder calibrated from 1 to 10E6 cps.

3. SR Startup Rate Meters calibrated from -0.5 to 5.0 decade per minute (dpm).

4. SR Audible Count Rate, and

5. SR High Flux at Shutdown Alarm (boron dilution alarm).

The SR Audible Count Rate and the SR High Flux at Shutdown Alarm provide the operators with prompt and definite indication of a boron dilution event.

ln Mode 2 (below P-6), and Modes 3, 4, and 5, with the RTBs closed, the following trip functions were available to mitigate a control rod withdrawalfrom subcriticalconditions:

1. lntermediate Range Rod Stop

2. lntermediate Range Neutron Flux Trip

3. Power Range Neutron Flux Trip - Low Range For a rod ejection accident the following trip functions were available:

1. lntermediate Range Neutron Flux Trip

2. Power Range Neutron Flux Trip (Low and High Range)

3. Power Range Neutron Flux - High Positive Rate ln addition, Operating Limitation E, given in Unit 1 GeneralOperating lnstruction (1-GO-2), "Reactor Startup,' Section 3.2, provides the operator the following directions should an unexplained increase in source range counts were to occur.

Operating Limitation E:

"lf at any point during the approach to criticality, ONE of the two Source Ranges shows an unexplained rise in count rate by a factor of 5 or greater, or if BOTH Source Ranges show an unexplained rise in count rate by a factor ot 2 or greater, the approach to critical shall be SUSPENDED IMMEDIATELY and the control rods FULLY INSERTED (i.e., rod withdrawaland/or boron dilution shall be terminated). Further positive reactivity changes shall not be resumed UNTIL an evaluation is performed, Plant Manager approvalobtained, and the SM authorizes resuming the approach to critical."

Based on the starting flux of 30 cps, operators would be directed to take actions well before the Source Range High Flux Trip Setpoint (10E5 cps) was reached. Therefore, the operator has more than the

UFSAR required 15 minutes to terminate the event using the ChemicalVolume Control System (CVCS) or the Emergency Core Cooling Systems (ECCS) to borate the reactor coolant system (RCS) before a loss of SDM occurs.

B. For events that occurred when the reactor was shut down, availability of systems or components needed to shut down the reactor and maintain safe shut down conditions, remove residual heat, control the release of radioactive material, or mitigate the consequences of an accident.

During the time that the reactor was in Mode 3 with the RTBs closed, the ability to mitigate a control rod withdrawal from subcritical conditions, rod ejection or a boron dilution event were not compromised for the reasons given above. ln addition, the availability of systems and components needed to remove residual heat and control of radioactive material was verified by the completion of the Mode 4 to Mode 3 Checklist on October 18,2015.

C. For failure that rendered a train of a safety system inoperable, an estimate of the elapsed time from discovery of the failure until the train was returned to service.

The SR level trip channels were discovered to be inoperable in Mode 1 on October 22,2015, at approximately 1000 EDT. Following discovery, the SR leveltrip switches were restored to their NORMAL position on October 22,2015, at 1258 EDT.

VI. CORRECTIVE ACTIONS

This event was entered into the TVA Corrective Action Program and is being tracked under CR 1096405.

A. lmmediate Corrective Actions SR leveltrip switches were returned to NORMAL and a prompt investigation started. Power Escalation Test Procedures 1-PET-105 and 2-PET-105 placed in Administrative Hold pending correction of deficiency. Power ascension was held until immediate corrective actions were established and verified effective for MCR oversight and control board awareness.

B. Corrective Actions to Prevent Recurrence (CAPR)

CAPR-O1 - Establish explicit practices using NPG-SPP-10.1, "System Status Control,'to ensure that Component Status Sheet or equivalent reinforce the existing requirements for 100% As-Found/As-Left configuration control within work order documents and procedures.

CAPR-O2 - Revise ODM-12, "Use of lnformationalAids," to establish flagging standards and expectations for activities not completed within one operations shift.

CAPR-O3 - Revise 1-Pl-OPS-1-MCR, "Main Control Room," and 1-PI-OPS-ANN, "AnnunciatorVerification,"

to transition the short term actions of Standing Order 15-008 into sustainable effective practices for tracking of annunciators and the documentation of cause.

VII. ADDITIONAL INFORMATION

A. Previous similar events at the same plant LER 2008-001-00 On May 19, 2008, TVA submifted LER 2008-001-00, "Automatic Safety Injection Actuation Blocked in Modes 4 and 3." This LER describes a condition where jumpers were installed to block automatic Safety lnjection (SI) during refueling but were not removed when the plant entered Mode 4. The automatic Sl function is required in Modes I,2, 3, and 4 per Function 1.b of Table 3.3.2-1 of LCO 3.3.2. Since both trains were inoperable, LCO 3.0.3 was entered until the jumpers were removed and the reactor trip breakers cycled to reset the Sl signal.

The cause was attributed to an inadequate GeneralOperating (GO) lnstruction and an inadequate lnstrument Maintenance lnstruction (lMl). This event is similar to the condition described in this LER in that a safety function was defeated by procedure and not tracked or validated or restored prior to entering Mode 3 with the RTBs closed.

LER 201 1-001-01 On July 8,2011, TVA submitted LER 2011-001-01, "Safety lnjection Pump Capable of lnjecting into Reactor Coolant System in Mode 5." One safety injection (Sl) pump in Mode 5 is normally used to fill and vent the cold leg accumulators (CLAs) in accordance with SOI3.01. During performance of this procedure, Sl pump 1A-A crosstie valve 1-FCV3-152 is closed to preclude injecting directly into the reactor coolant system. However, previously in Mode 6, a temporary clearance lift was issued to open 1-FCV3-152 to perform safety injection full flow testing in accordance with 1-5163-906. Following completion of this surveillance Sl pump 1A-A was secured, but the crosstie valve 1-FCV-63-152 was not closed. Not realizing that the crosstie valve was open, the operations personnel resumed filling and venting the CLAs in accordance with SOI3.01. Sl pump 1A-A was started and RCS pressure immediately began to rise and reached a maximum pressure of 328 psig before the operators secured the pump. Failure to close 1-FCV3-152 was attributed to failure to comply with plant clearance procedures for system alignment, in that the clearance was restored without verifying valve position.

This event involved the same underlying cause as was reported in this LER in that operating personnel failed to identify, track, and validate a defeated safety function.

LER 20't2-03-01 On January 8, 2014, TVA submitted revised LER 2012-03-01, "Entry to Mode 4 without Meeting LCO 3.4.12, Cold Overpressure Mitigation System (COMS).' This LER describes a condition where Unit 1 entered Mode 4 as part of the Cycle 9 refueling outage (RFO). When Mode 4 was entered, two Safety lnjection (Sl) pumps and more than one Centrifugal Charging Pump (CCP) were capable of injecting into the Reactor Coolant System (RCS). TS 3.4.12, "Cold Overpressure Mitigation System (COMS),' requires that a maximum of one CCP and no SI pumps be capable of injecting into the RCS when in Modes 4, 5, or 6 (with the reactor head on). As a result, LCO 3.4.12 was not met and the applicable Required Actions were not taken within their associated Completion Times. A review of previous operating data revealed this condition also existed on April 4,2011, when WBN entered Mode 4 as a part of the Cycle 10 RFO. These events are similar to the event described in this LER in that a mode or other specified condition was entered with operators personnel unaware that plant configuration was such that TS requirements were not satisfied for the new mode or other specified condition.

B. Additional lnformation None.

C. Safety System Functional Failure Consideration This condition resulted in a safety system functionalfailure in accordance with 10 CFR 50.73(aX2XvXA).

D. Scrams with Complications Consideration There was no scram associated with this report.

VIII. COMMITMENTS

None.

I.

PLANT OPERATING CONDITIONS BEFORE THE EVENT

Watts Bar Nuclear Plant (WBN) Unit 1 was in Mode 3 with two Source Range (SR) channels providing flux indication and alarms, SR leveltrip channels bypassed, and the reactor trip breakers (RTBs) [EllS:BKR]open.

II.

DESCRIPTION OF EVENT

A. Event On October 7,2015, at'1414 Eastern Daylight Time (EDT) prior to core reload during the Cycle 13 Refueling Outage, the level trip switches [EllS:lG] for the SR Level Trip Channels (N-31 and N-32) were placed in the bypass position in accordance with Power Escalation Test Procedure 1-PET-105 Revision 3.

The SR leveltrip switches are placed in the bypass position to avoid potential SR trips and alarms during core alterations. Core reload was completed on October 9, 2015 at approximately 1830 EDT with the SR level trip switches remaining in the bypass position. At this point, the SR level trip switches should have been placed back to the normal position; however, Revision '1 of 1-PET-105, dated July 19, 2013, had inadvertently omitted the step. The SR leveltrip switches are located on the SR drawers on panel 1-M-13 in the main control room (MCR) and are primarily used to test, calibrate or place a failed instrument channel in bypass.

On October 19,2015, at2139 EDT, with the plant in Mode 3 the RTBs were closed to accommodate control rod testing. This action resulted in a specified condition entry violation in accordance with Technical Specifications (TS) Limiting Condition for Operation (LCO) 3.0.4 and a violation of TS 3.3.1, Table 3.3.1-1, Function 5 because two SR level trip channels were inoperable with the RTBs closed and the Rod Control System [ElIS:AA] capable of rod withdrawal. Under these conditions, TS 3.3.1, Required Actions A.1 and J.1, required that the operators take immediate actions to open the RTBs. This action was not performed because the operators were not aware of the position of the SR level trip switches at the time the RTBs were closed.

On October 21,2015 at 0346 EDT, the plant entered Mode 2 with both SR level trip channels inoperable.

This was a mode change violation in accordance with LCO 3.0.4. Under these conditions, TS 3.3.1, Required Actions 4.1, 1.1 and J.1, required that the operators take immediate actions to suspend operations involving positive reactivity additions and open the RTBs. On October 21,2015 at 0623 EDT, reactor power was increased above the P permissive interlock and the SR high flux trip signals were then blocked using General Operating lnstruction (1-GO-2), "Reactor Startup," at approximately 0625 EDT. The SR leveltrip channels are required to be blocked above P to avoid reactor trip during power ascension.

On October 21,2015 at 1749 EDT, the plant entered Mode 1. On October 22,2015, at approximately 1000 EDT the operating staff discovered that the SR level trip switches were in the bypass position. At the time of discovery the plant was in Mode 1 at27 percent RTP. Following discovery, the SR level trip switches were restored to their normal position on October 22,2015, at 1258 EDT. At the time of discovery there were no TS applicability requirements for the SR high flux trip function because reactor power was above the P6 permissive interlock. The required TS were not met between October 19,2015, at2139 EDT and October 21,2015, at 0623 EDT. As a result, this condition is reportable in accordance with 10 CFR 50.73(a)(2)(v)(A), "Any event or condition that could have prevented the fulfillment of the safe$ function of structures or systems that are needed to shut down the reactor and maintain it in a safe shutdown condition," and 10 CFR 50.73(aX2Xi)(B), "Any operation or condition which was prohibited by the plant's Technical Specifications."

B.

lnoperable Structures, Components, or Systems that Contributed to the Event No inoperable structures, components, or systems contributed to this event.

C. Dates and Approximate Times of Occurrences

Date Time (EDT)

Event 10t07 t2015 1414 SR level trip switches located at the SR drawers placed in the Bypass position prior to core reload in accordance with 1-PET-105. This action caused the SR leveltrip channels (N31 and N32) to be inoperable.

10t09t2015 1 830 Core reload completed without properly restoring SR level trip switches to Normal position.

10t18t2015 1 500 Entered Mode 3.

10t19t2015 2139 Closed RTBs with both SR level trip channels inoperable (specified condition entry violation per TS LCO 3.0.4 and TS 3.3.1 Required Actions A.1 and J.1).

10t21t2015 0346 Entered Mode 2 (specified condition entry violation per TS LCO 3.0.4 and TS 3.3.1 Required Actions A.'l, 1.1, and J.1).

10t21t2015 0623 Intermediate Range power exceeded P-6 permissive interlock.

10t21t2015 0625 SR level trip channels blocked in accordance with 1-GO-Z at main control board (TS 3.3.1 Function 5 no lonser applicable).

10t21t2015 1749 Entered Mode 1.

10t22t2015 1 000 Reactor at 27 percent RTP, operator discovered both SR level trip switches in the Bypassed position.

10t22t2015 1258 SR level trip switches for both trip channels (N31 and N32) placed in the Normal position.

D. Manufacturer and Model Number of Components that Failed There were no failed components associated with this event.

E. Other Systems or Secondary Functions Affected

There were no systems or secondary functions affected by this event.

F. Method of discovery of each Component or System Failure or Procedural Error

Review of Control Board annunciators was the initial method for discovery of the mis-positioned switches.

G. Failure Mode and Effect of Each Failed Component There were no component failures associated with this event.

H. Operator Actions

Upon discovery of the inoperable SR high flux trip function, operations personnel documented the condition in the Corrective Action Program as Condition Report (CR) 1096405, evaluated plant status and returned the SR leveltrip switches to the Normal position.

l. Automatically and Manually lnitiated Safety System Responses

There was no automatic or manualsystem responses associated with this event.

III.

CAUSE OF THE EVENT

A. The cause of each component or system failure or personnel error, if known.

There were no component or system failures as a result of this event notification. The SR level trip channels were inoperable due to human performance error and inadequate startup procedures.

B. The cause(s) and circumstances for each human performance related root cause.

The root cause was that the operators failed to identify a bypassed safety function during reactor testing and start-up due to inadequate tracking and validation of essential information. A contributing cause was inadequate operating procedures used to control SR level trip switches prior to core reload.

IV. ANALYSIS OF THE EVENT

The SR level trip channels and associated alarms are designed to provide core protection for the following Condition ll and lV events.

a. boron dilution event during startup (Condition ll),

b. uncontrolled rod bank withdrawal from subcritical conditions (Condition ll), and c. rod ejection accident at hot zero power (Condition lV).

For Mode 6 Chapter 15 of the Updated Final Safety Analysis Report (UFSAR) credits administrative controls to preclude boron dilution events by isolating the RCS from potential sources of un-borated water. Although the UFSAR does not assume a boron dilution event in Mode 6, the SR Audio Count Rate and the High Flux at Shutdown Alarm were available in accordance with TS LCO 3.9.3, Nuclear lnstrumentation, to provide containment evacuation and to alert the operators to a potential boron dilution event or an improperly loaded fuel assembly. ln addition, uncontrolled rod bank withdrawal from subcritical conditions or a rod ejection accident were not creditable in Mode 6 because the Control Rod Drive Mechanisms (CRDMS) were unlatched from the Rod Cluster Control Assembly (RCCAS) and the reactor vessel head was either removed or the closure bolts were de-tensioned preventing any pressure buildup.

For Modes 3, 4, and 5, with the RTBs open, TS LCO 3.3.1, Table 3.3.1-1, Function 5, requires that one SR channel be operable to monitor core neutron flux levels and provide visual indication and audible alarm of reactivity changes that may occur as a result of a boron dilution event. For a boron dilution event, UFSAR Table 15.2-1 credits the alarms associated with the SR level trip channels as the primary means to alert the operator that a boron dilution accident is in progress. For this event the operator has more than 15 minutes to terminate the event using the ChemicalVolume Control System (CVCS) [EllS:CB] or the Emergency Core Cooling Systems (ECCS) [EllS:BQ] to borate the reactor coolant system (RCS) [ElIS:AB] before a loss of Shutdown Margin (SDM) occurs. The safety functions to monitor core reactivity for the above modes were met with two SR monitoring channels operable (see Section V.A for list of operable SR instrumentation). Core protection for an uncontrolled rod bank withdrawal from subcritical conditions and a potential rod ejection accident at hot zero power were met with the RTBs open.

For Mode 2 (below P), and Modes 3, 4, and 5, with the RTBs closed and the Rod Control System [EllS:AA]

capable of rod withdrawal, TS LCO 3.3.1, Table 3.3.1-1, Function 5, requires that two SR level trip channels be operable to provide core protection for a boron dilution event, uncontrolled rod bank withdrawal from subcritical conditions or a rod ejection accident. Two operable SR level trip channels ensure that no single random failure willdisable the SR trip function. These safety functions were not met in Mode 3 because the SR leveltrip channels were bypassed with the RTBs closed.

Above the P6 permissive interlock, the intermediate and power range trip channels provide core protection for allCondition ll, llland lV Events.

Because the SR leveltrip channels were inoperable in Mode 3 with the RTBs closed below the P.6 permissive interlock, the above safety functions were not satisfied. The potentialconsequences of not meeting TS LCO 3.3.1 are given in the following sections.

V.

ASSESSMENT OF SAFETY CONSEQUENCES

A. Availability of systems or components that could have performed the same function as the components and systems that failed during the event.

ln Modes 3, 4, and 5, with the RTBs open, the following SR instrumentations and alarms were available to alert the operator of a potential boron dilution event:

1. SR Neutron Flux Meters calibrated logarithmically from 1 to 10E6 counts per second (cps).

2. SR Neutron Flux Recorder calibrated from 1 to 10E6 cps.

3. SR Startup Rate Meters calibrated from -0.5 to 5.0 decade per minute (dpm).

4. SR Audible Count Rate, and

5. SR High Flux at Shutdown Alarm (boron dilution alarm).

The SR Audible Count Rate and the SR High Flux at Shutdown Alarm provide the operators with prompt and definite indication of a boron dilution event.

ln Mode 2 (below P-6), and Modes 3, 4, and 5, with the RTBs closed, the following trip functions were available to mitigate a control rod withdrawalfrom subcriticalconditions:

1. lntermediate Range Rod Stop

2. lntermediate Range Neutron Flux Trip

3. Power Range Neutron Flux Trip - Low Range For a rod ejection accident the following trip functions were available:

1. lntermediate Range Neutron Flux Trip

2. Power Range Neutron Flux Trip (Low and High Range)

3. Power Range Neutron Flux - High Positive Rate ln addition, Operating Limitation E, given in Unit 1 GeneralOperating lnstruction (1-GO-2), "Reactor Startup,' Section 3.2, provides the operator the following directions should an unexplained increase in source range counts were to occur.

Operating Limitation E:

"lf at any point during the approach to criticality, ONE of the two Source Ranges shows an unexplained rise in count rate by a factor of 5 or greater, or if BOTH Source Ranges show an unexplained rise in count rate by a factor ot 2 or greater, the approach to critical shall be SUSPENDED IMMEDIATELY and the control rods FULLY INSERTED (i.e., rod withdrawaland/or boron dilution shall be terminated). Further positive reactivity changes shall not be resumed UNTIL an evaluation is performed, Plant Manager approvalobtained, and the SM authorizes resuming the approach to critical."

Based on the starting flux of 30 cps, operators would be directed to take actions well before the Source Range High Flux Trip Setpoint (10E5 cps) was reached. Therefore, the operator has more than the

UFSAR required 15 minutes to terminate the event using the ChemicalVolume Control System (CVCS) or the Emergency Core Cooling Systems (ECCS) to borate the reactor coolant system (RCS) before a loss of SDM occurs.

B. For events that occurred when the reactor was shut down, availability of systems or components needed to shut down the reactor and maintain safe shut down conditions, remove residual heat, control the release of radioactive material, or mitigate the consequences of an accident.

During the time that the reactor was in Mode 3 with the RTBs closed, the ability to mitigate a control rod withdrawal from subcritical conditions, rod ejection or a boron dilution event were not compromised for the reasons given above. ln addition, the availability of systems and components needed to remove residual heat and control of radioactive material was verified by the completion of the Mode 4 to Mode 3 Checklist on October 18,2015.

C. For failure that rendered a train of a safety system inoperable, an estimate of the elapsed time from discovery of the failure until the train was returned to service.

The SR level trip channels were discovered to be inoperable in Mode 1 on October 22,2015, at approximately 1000 EDT. Following discovery, the SR leveltrip switches were restored to their NORMAL position on October 22,2015, at 1258 EDT.

VI. CORRECTIVE ACTIONS

This event was entered into the TVA Corrective Action Program and is being tracked under CR 1096405.

A. lmmediate Corrective Actions SR leveltrip switches were returned to NORMAL and a prompt investigation started. Power Escalation Test Procedures 1-PET-105 and 2-PET-105 placed in Administrative Hold pending correction of deficiency. Power ascension was held until immediate corrective actions were established and verified effective for MCR oversight and control board awareness.

B. Corrective Actions to Prevent Recurrence (CAPR)

CAPR-O1 - Establish explicit practices using NPG-SPP-10.1, "System Status Control,'to ensure that Component Status Sheet or equivalent reinforce the existing requirements for 100% As-Found/As-Left configuration control within work order documents and procedures.

CAPR-O2 - Revise ODM-12, "Use of lnformationalAids," to establish flagging standards and expectations for activities not completed within one operations shift.

CAPR-O3 - Revise 1-Pl-OPS-1-MCR, "Main Control Room," and 1-PI-OPS-ANN, "AnnunciatorVerification,"

to transition the short term actions of Standing Order 15-008 into sustainable effective practices for tracking of annunciators and the documentation of cause.

VII. ADDITIONAL INFORMATION

A. Previous similar events at the same plant LER 2008-001-00 On May 19, 2008, TVA submifted LER 2008-001-00, "Automatic Safety Injection Actuation Blocked in Modes 4 and 3." This LER describes a condition where jumpers were installed to block automatic Safety lnjection (SI) during refueling but were not removed when the plant entered Mode 4. The automatic Sl function is required in Modes I,2, 3, and 4 per Function 1.b of Table 3.3.2-1 of LCO 3.3.2. Since both trains were inoperable, LCO 3.0.3 was entered until the jumpers were removed and the reactor trip breakers cycled to reset the Sl signal.

The cause was attributed to an inadequate GeneralOperating (GO) lnstruction and an inadequate lnstrument Maintenance lnstruction (lMl). This event is similar to the condition described in this LER in that a safety function was defeated by procedure and not tracked or validated or restored prior to entering Mode 3 with the RTBs closed.

LER 201 1-001-01 On July 8,2011, TVA submitted LER 2011-001-01, "Safety lnjection Pump Capable of lnjecting into Reactor Coolant System in Mode 5." One safety injection (Sl) pump in Mode 5 is normally used to fill and vent the cold leg accumulators (CLAs) in accordance with SOI3.01. During performance of this procedure, Sl pump 1A-A crosstie valve 1-FCV3-152 is closed to preclude injecting directly into the reactor coolant system. However, previously in Mode 6, a temporary clearance lift was issued to open 1-FCV3-152 to perform safety injection full flow testing in accordance with 1-5163-906. Following completion of this surveillance Sl pump 1A-A was secured, but the crosstie valve 1-FCV-63-152 was not closed. Not realizing that the crosstie valve was open, the operations personnel resumed filling and venting the CLAs in accordance with SOI3.01. Sl pump 1A-A was started and RCS pressure immediately began to rise and reached a maximum pressure of 328 psig before the operators secured the pump. Failure to close 1-FCV3-152 was attributed to failure to comply with plant clearance procedures for system alignment, in that the clearance was restored without verifying valve position.

This event involved the same underlying cause as was reported in this LER in that operating personnel failed to identify, track, and validate a defeated safety function.

LER 20't2-03-01 On January 8, 2014, TVA submitted revised LER 2012-03-01, "Entry to Mode 4 without Meeting LCO 3.4.12, Cold Overpressure Mitigation System (COMS).' This LER describes a condition where Unit 1 entered Mode 4 as part of the Cycle 9 refueling outage (RFO). When Mode 4 was entered, two Safety lnjection (Sl) pumps and more than one Centrifugal Charging Pump (CCP) were capable of injecting into the Reactor Coolant System (RCS). TS 3.4.12, "Cold Overpressure Mitigation System (COMS),' requires that a maximum of one CCP and no SI pumps be capable of injecting into the RCS when in Modes 4, 5, or 6 (with the reactor head on). As a result, LCO 3.4.12 was not met and the applicable Required Actions were not taken within their associated Completion Times. A review of previous operating data revealed this condition also existed on April 4,2011, when WBN entered Mode 4 as a part of the Cycle 10 RFO. These events are similar to the event described in this LER in that a mode or other specified condition was entered with operators personnel unaware that plant configuration was such that TS requirements were not satisfied for the new mode or other specified condition.

B. Additional lnformation None.

C. Safety System Functional Failure Consideration This condition resulted in a safety system functionalfailure in accordance with 10 CFR 50.73(aX2XvXA).

D. Scrams with Complications Consideration There was no scram associated with this report.

VIII. COMMITMENTS

None.