Semantic search

On November 3, 2016, as a result of a containment sump pump alarm, operations obtained from Chemistry a sample which indicated a Service Water (SW) leak due to abnormal chlorides levels.

Technical Specification (TS) 3.6.1 (Containment) was entered and containment declared inoperable.

Inspections identified a through wall leak on the 31 SW Fan Cooler Unit (FCU) from FCU coil 3 which - feeds a SW return line header. TS 3.6.6 (Containment Spay and Fan Cooler System) was entered when the 31 FCU was secured and SW to the 31 FCU was isolated. TS 3.6.1, Condition A was exited after the 31 FCU was secured and SW was isolated to the 31 FCU.

The leak is at a 3 inch butt-welded joint that is ISI Class 3, nuclear safety related.

Leak rate estimate was 0.16 gpm. The direct cause was a leak in a SW pipe due to a through-wall flaw as a result of corrosion.

The root cause is indeterminate. The specific. cause for the pipe joint defect requires the component to be removed and a metallurgical failure analysis performed. Corrective actions included installation of a leak limiting clamp. The clamp is being monitored daily and UT monitoring will be performed every 90 days until the pipe is repaired. The pipe will be replaced in the next refueling outage in 2017.

The affected pipe will be analyzed after removal. The event had no effect on public health and safety.

Indian Point 3 05000-286 APPROVED BY OMB: NO. 3150-0104 EXPIRES: 10/31/2018 comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by internet e-mail to Note: The Energy Industry Identification System Codes are identified within the brackets ().

DESCRIPTION OF EVENT

On November 3, 2016, while at 100 percent reactor power, operations received a "Vapor Containment (VC) Sump Pump Running," alarm at approximately 00:27 hours, following a VC sump pump out. In accordance with actions of 3-ARP-009, a check of the Unit Log identified that the last sump pump out was on October 30, 2016. Receipt of this alarm was earlier than expected and a possible indicator of a leak. VC radiation monitors R-11 and R-12 (IL), VC Humidity (1,7), and Fan Cooler Unit (FCU) Weir Levels WI were normal. As a result of the early VC Sump Pump Running alarm (FQA), operations requested Chemistry to obtain a sample of the VC pump out line. Results of the sample showed approximately 149 ppm chlorides, indicating a possible Service Water (SW) (BI) leak due to abnormal chloride levels. Operations entered Technical Specification (TS) 3.6.1 (Containment), Condition A (Containment Inoperable) at 03:00 hours, due to the possibility of a loss of containment (NH) integrity. At 3:19 hours, the 31 FCU (FCU) was secured due to suspected SW FCU coil leakage and entered TS 3.6.6 (Containment Spray System and Containment Fan Cooler System), Condition C (One Containment FCU Train Inoperable). At 3:19 hours, a Safety Function Determination was performed which concluded there had been a loss of safety function and VC became inoperable when indications of a possible SW leak was identified for the 31 FCU. At 3:44 hours, TS 3.6.1, Condition A was exited after the 31 FCU was secured and SW was isolated to the 31 FCU. The leak was recorded in Indian Point Energy Center (IPEC) corrective action program (CAP) as CR-IP3-2016-03607. An 8 hour non-emergency event notification (#52344) was made under 10 CFR 50.72(b) (3)(v) for a loss of safety function.

The SW System (SWS) (BI) is designed to supply cooling water from the Hudson River to various heat loads in both the primary and secondary portions of the plant. The design ensures a continuous flow of cooling water to those systems and components necessary for plant safety during normal operation and under abnormal or accident conditions. The SWS consists of two separate, 100% capacity, safety related cooling water headers. Each header is supplied by 3 pumps to include pump strainers, with SWS heat loads designated as either essential or non-essential.

The essential SWS heat loads are those which must be supplied with cooling water immediately in the event of a Loss of Cooling Accident (LOCA) and/or Loss of Offsite Power (LOOP). The essential SWS heat loads can be cooled by any two of the three SW pumps on the essential header. Either of the two SWS headers can be aligned to supply the essential heat loads or the non-essential SWS heat loads.

A VC entry was performed and inspections identified leak indications at the 31 FCU on the 3rd coil feeding the SW return line fPSP1. To confirm the specific leak location, scaffolding was erected and insulation was removed. A through wall leak was identified on the 31 SW Fan Cooler Unit (FCU) at weld B-297, in branch line C from FCU coil 3. This is one of the 3 inch SW return branch lines from the 31 FCU cooling coils which feeds a 10 inch SW return line header 12b upstream of containment penetration Mb. Line 12b is the SW system return piping from the 31 FCU back to the river.

comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by internet e-mail to 2016 - 001 - 00 The piping for the 3 inch cooling coil return line is 904L stainless steel (SS) with a nominal pipe wall thickness for Schedule 40 pipe (0.216 inches). Leak rate estimate was 0.16 gpm. The leak is at a 3 inch butt-welded joint between a 904L stainless steel elbow (PSF) and pipe IPSP1 located on approximately the 76 foot elevation in containment. The piping leak is in a moderate energy ASME ISI Code Class 3, nuclear safety related piping system. 904L SS material is susceptible to the development of corrosion pits. Pin hole leaks and weld defects in this piping have previously occurred and have been evaluated. The evaluation concluded the 904L piping does not have a general corrosion problem.. Current analysis for SW pipe failures are postulated to be limited to small through-wall leakage flaws as opposed to guillotine breaks. There is no evidence of leakage at any other location on this weld or elsewhere on the piping adjacent to it.

Code Class 3 piping systems are addressed in ASME Code Case N-513-3. This Code Case provides the requirements for demonstrating structural integrity and therefore operability of a flawed pipe section. Characterization of the weld condition was performed by conducting an ultrasonic examination (UT) on November 4, 2016. The weld was examined circumferentially in a 1/5 inch by '1 inch grid pattern and by using a bulls-eye grid pattern in '4 inch increments. These UT, (Non Destructive Examinations) NDE results were documented in an NDE report. However, due to physical obstructions presented by the FCU enclosure, two circumferential grid rows on the backside of the weld could not be reached. Due to the leak location on the bottom side of the pipe on the side opposite from the FCU enclosure, the bulls-eye grid was not obstructed, and all required readings were taken. As a result of limited access, the UT examination of weld B297 resulted in completion of only approximately 70 percent of the circumference of the weld. The remaining 30 percent (approximately 3 inches) was unable to be inspected due to space constraints between the weld and the adjacent FCU plenum wall. ASME Code Case N-513-3 requires the flaw geometry to be characterized by volumetric inspection methods or by physical measurement. It mandates that the full pipe circumference at the flaw location be inspected to characterize the length and depth of all flaws in the pipe section.

Since a full volumetric examination could not be completed, the Code Case requirements could not be met. An immediate on-line weld repair of the defect was not considered feasible due to restrictions preventing 360 degree access, time required for work prep, and the potential for excessive sump filtration loading. As such, an NRC Relief Request to deviate from the 10CFR50.55a ASME Code requirements, specifically full compliance with ASME CC-N-513-3 was required. Therefore, pursuant to 10CFR50.55a(z)(2) Entergy requested relief by letter NL-16-133 (Request IP3-ISI- RR-10, Alternative to the Full Circumferential Inspection Requirement of Code Case N- 513-3), dated November 7, 2016. The NRC approved the relief request which concluded the inability to obtain full circumference readings does not adversely impact the ability to fully characterize the weld condition vs the code case requirements.

comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by internet e-mail to The approval of the relief request allowed Entergy to re-establish SW to the FCU to verify that leakage limits are met using a qualified clamp over the pinhole leak.

The leakage will be inspected daily in accordance with the Code Case requirements.

SW piping to the 31 FCU must be isolated when an allowable leakage is exceeded. The qualified clamp is an engineered clam-shell type clamp comprised on an outer metal jacket and rubber gasket. The clamp is classified as a temporary modification. The clamp will withstand post-accident containment pressure, temperature and environment, is located away from potential missiles and, pipe whip effects, is dedicated for safety-related use, and is rigidly attached to Seismic Category 1 piping. The clamp over the defect will return the system to its original containment integrity configuration and allow the 31 FCU to remain operable.

The defect in the SW return pipe from the 31 FCU was evaluated with respect to TS 5.5.15 (Containment Leak Rate Testing Program), and the Appendix J Leakage program.

TS 5.5.15 requires that the SW in-leakage into containment must be limited to less than 0.36 gpm per FCU when pressurized equal to or greater than 1.1Pa. This limit protects the internal recirculation pumps from flooding during the 12 month period of post-accident recirculation. TS 5.5.15 also implements the leakage rate testing of the containment as required by 10CFR50, Appendix J. The maximum leakage to assure that the post-accident containment leakage remains within allowable limits is 0.023 gpm. This limit is based upon an evaluation to calculate the amount of SW which can leak through this pinhole under normal system operating conditions to ensure that 10CFR50 appendix J containment leakage limits are not exceeded under any mode of operation including accident conditions. The leak does not impinge upon any safety related equipment. As a result, no damage from the leakage is expected to occur.

Based on UT measured readings from the NDE Report, a new calculation was generated (IP-CALC-16-00079 FCU 31 Leak) per the ASME CC-N-513-3 requirements. The minimum required thickness for the elbow containing the weld B297 is 0.073 inches. The minimum measured thickness was 0.117 inches. The maximum allowable axial flaw size is 4.11 inches and the maximum allowable circumferential flaw size is 3.65 inches.

The existing flaw is characterized as approximately 0.50 inches by 0.50 inches, and the uninspected arc length (approximately 3 inches) of the pipe circumference is less than the allowable circumferential flaw length. Therefore, if the entirety of the uninspected portion of the pipe were to be considered a flaw, the pipe would still retain its structural integrity as evaluated in the new calculation. The pinhole flaw is opposite the uninspected portion and the flaw sizes of the two areas are independent and not additive. Based on this information, the pipe is structurally adequate for service consistent with the requirements of ASME Code Case N-513-3. The remaining service life was calculated to be 3.3 years, which is beyond the next scheduled refueling outage in the spring 2017 when a permanent repair will be made.

An extent of condition review determined the Code Case requires five similar and susceptible locations in the SW system to be volumetrically examined. NDEs were performed on November 5, 2016, on five 31 FCU SW pipe welds and recorded in NDE reports. All five weld locations were found to be structurally acceptable and documented in CR-IP3-2016-03607, corrective action (CA-6). The additional inspections confirm the integrity of the SW piping inspected since all UT data measurements were above the 87.5 percent of pipe nominal wall thickness. Also, there was no evidence of additional leakage at any other place in the 31 FCU 3 inch return line or at any other location in the other four FCU return lines. Unit 2 does not apply as it does not have similar 904L SS FCU supply or return lines.

comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by internet e-mail to

CAUSE OF EVENT

The direct cause was a SW leak associated with the 31 FCU at weld B297 in branch line C from coil 3 feeding the 10 inch SW return line 12b. The leak was from a through-wall pinhole flaw at a butt-welded joint between a 904L SS elbow and pipe in containment. The likely degradation mechanism leading to the leak was corrosion. The pipe with the flaw resulted in containment out leakage in excess of 10CFR50, Appendix J limits. The root cause is indeterminate. The specific cause for the pipe joint defect requires the component to be removed and a metallurgical failure analysis performed.

CORRECTIVE ACTIONS

The following corrective actions have been or will be performed under the Corrective Action Program (CAP) to address the causes of this event:

• A leak-limiting engineered clam-shell type clamp was applied to the pipe flaw.

• The clamp is being monitored daily by a special operator log for any signs of increased leakage. The maximum allowed leakage rate past the clamp is 0.023 gpm.

• UT monitoring will be performed every 90 days until the pipe is repaired.

• The pipe/elbow will be replaced in the next refueling outage (RO) in the spring 2017.

• The removed pipe/elbow will be inspected and a metallurgical analysis performed by an independent vendor to determine the specific cause.

• A volumetric inspection of a sample of 3 inch 904L SS butt-welds at the 32, 33, 34, and 35 FCUs will be performed in the spring 2017 RO.

• The Generic Letter 89-13 Program will be revised to include a requirement to conduct a definitive number of 904L weld volumetric inspections each pre-outage interval.

• This LER will be updated after engineering review of the metallurgical analysis and revision as necessary of the cause analysis.

EVENT ANALYSIS

The event is reportable under 10 CFR 50.73(a)(2)(v)(C). The licensee shall report any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to (C) Control the release of radioactive material. This condition meets the reporting criteria because TS 3.6.1 Containment Operability was not met.

comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by internet e-mail to The pipe flaw leakage was approximately 0.16 gpm which was greater than the calculated 10 CFR 50, Appendix J allowable leak rate of 0.023 gpm. TS 3.6.1 (Containment) requires the containment to be operable in Modes 1-4. TS Surveillance Requirement (SR) 3.6.1.1 requires visual examinations and leakage rate testing in accordance with the containment Leakage Rate Testing Program specified in TS 5.5.15.

SR 3.6.1.1 leakage rate requirements comply with 10 CFR 50, Appendix J, Option B. As SW is required in an accident, the SW to the FCU would not be isolated in DBA and the piping credited as a closed system inside containment for containment integrity.

Consequently, defects discovered within the FCU SW piping may adversely affect containment integrity and the ability to control releases of radioactive material.

The condition also meets the reporting criteria of 10 CFR 50.73(a) (2)(i)(B). The licensee shall report any operation or condition which was prohibited by the plant's TS. During the previous period of operation for an unknown period of time the SW pipe contained a through wall leak that did not meet code requirements. This previously unrecognized condition required entry into TS 3.7.9 and corrective actions implemented to return the pipe to operable. Failure to comply with the TS LCO and perform required actions is a TS prohibited condition.

PAST SIMILAR EVENTS

A review of the past three years of Licensee Event Reports (LERs) for events that involved containment integrity due to flawed piping credited as a closed system inside containment. No applicable LERs were identified. There was one LER, LER-2014- 002 reporting a Technical Specification prohibited condition for a flaw discovered on a SW pipe connected to the Component Cooling Water Heat Exchanger. This LER is not similar as the impacted piping is outside containment and not credited as a closed system for containment integrity.

SAFETY SIGNIFICANCE

This condition had no effect on the health and safety of the public.

There were no actual safety consequences for the event because there were no accidents or events during the degraded condition.

There were no significant potential safety consequences of this event. The leakage from the affected SW pipe was within the capability of the SW system to provide adequate SW flow to SW loads. The degraded piping was on the discharge of the FCU therefore any failure would not prevent the SW cooling function. Current analysis for SW pipe failures are postulated to be limited to small through-wall leakage flaws as SW is defined as a moderate energy fluid system. The SW leak would eventually drain to the containment sump. The containment sumps have pumps with sufficient capacity to remove excessive leakage and instrumentation to alert operators to a degraded condition.

comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by internet e-mail to The containment consists of the concrete reactor building, its steel liner, and the penetrations through the structure. The containment building is designed to contain radioactive material that might be released from the reactor following a design basis accident (DBA). The containment building steel liner and its penetrations establish the leakage limiting boundary of the containment. Maintaining the containment operable limits the leakage of fission product radioactivity from the containment to the environment. The DBA analysis assumes that the containment is operable such that, for the DBAs involving release of fission product radioactivity, release to the environment is controlled by the rate of containment leakage.

The containment was designed with an allowable leakage rate of 0.1 percent of containment air weight per day. Containment isolation valves form a part of the containment pressure boundary. Two barriers in series are provided for each penetration so that no single credible failure or malfunction of an active component can result in a loss of isolation or leakage that exceeds limits assumed in the safety analysis. One of these barriers may be a closed system such as the SW piping for the FCUs. The only time containment integrity can be affected is post accident when the FCUs safety function is being performed and SW pressure for the FCU cooling piping and coils fall below peak accident pressure. Mitigation of radiation release by the degraded SW pipe pathway can be by use of radiation monitors R-16A and R-16B which monitor containment fan cooling water for radiation indicative of a leak from the containment atmosphere into the cooling water. If radiation is detected, each FCU heat exchanger can be individually sampled to determine the leaking unit. The SW for the 31 FCU can be isolated to prevent radioactive effluent releases. During the time the FCU SW piping was degraded there was no leakage out of containment.

A risk assessment was performed to determine the overall probability of a core damage event which could cause a loss 'of containment integrity due to a SW to FCU leak assuming it would take 5 days to detect a SW leak to a FCU. The risk result was 7.8E-8 which is considered negligible in terms of both core damage and large early release.

Indian Point 3 05000-286

Technical Specification 3.7.6. A pinhole sized through wall leak was discovered on the downstream side of CD-123, the 32 Auxiliary Boiler Feed Pump Bearing Cooling Relief Valve, which was unisolable to the Condensate Storage Tank.

The pinhole leak was identified following the performance of 3PT-Q120B, 32 Auxiliary Boiler Feed Pump Functional Test. All Operability and Acceptance Criteria of 3PT-Q120B were sat. The relief valve was removed from the system and sent to a vendor for evaluation. After the vendor evaluation, it was determined that the valve pinhole area leak was due to a casting defect.

This event was determined to be reportable as a Loss of Safety Function pursuant to10 CFR 50.72(b)(3)(v)(B) - Any event or condition that at the time of discovery could have prevented the fulfillment of the safety function of structures or systems that are needed to remove residual heat.

RC FORM 366 (04-2017)

On March 6, 2017, Instrumentation and Control (I&C) maintenance had a scheduled activity to calibrate the 22 Steam Generator (SG) Auxiliary Feedwater (AFW) flow indicator (FI-1201). The tag-out was applied by Operations at 0748 hours on the two flow transmitter root stop valves. l&C personnel began to calibrate FI-1201 at approximately 1000 hours. The calibration Procedure requires isolation of the high and low isolation valves and opening of the equalizing valve to allow venting of any pressure going to the transmitter. The calibration was performed and all as-found readings were within acceptance range. The test equipment was removed. The transmitter restoration was completed with the exception of filling and venting the transmitter FI-1201 and placing it back in service. Due to the root valves being tagged out, the source of water was isolated preventing proper filling and venting of the transmitter. The l&C supervisor discussed the restoration 'of the transmitter with the Operations shift manager, and it was agreed that Operations would complete restoration of the transmitter when the tag-out was removed. The l&C supervisor noted this and marked NA for the steps to return the transmitter back in service. This is a common practice when performing transmitter calibrations as a part of larger work windows because the tag-out must first be removed for a source of water to be available for restoration. However, the l&C supervisor did not obtain the Shift Manager's initials, which is required by Procedure.

ConSequently, Operations did not restore the transmitter to service, resulting in FI-1201 remaining inoperable for greater than the Technical Specification 3.3.3 allowed completion time of 30 days. It should be noted that in spite of inoperability of FI-1201, since FI-1201 is indication only, there was no actual loss or degradation of water flow to the steam generators at any time and thus had no impact on SG heat removal capability.

On June 11, 2017, while at 100 percent reactor power, Operations placed Chemical and Volume Control System (CVCS) Demineralizer Diversion Valve CH-TCV-149 in DIVERT to allow the 32 Mixed Bed Demineralizer to be removed from service and align the 31 Mixed Bed Demineralizer for service. Within about two minutes after returning CH-TCV-149 to AUTO, which placed the 31 Mixed Bed Demineralizer in service, Letdown Backpressure Control Valve CH-PCV-135 demand had gone to 0 percent (full open demand) while letdown backpressure had increased, reaching 302 psig.

Operations was alerted to a leak that had developed on 32 Mixed Bed Demineralizer Inlet Isolation Valve CH-352. In an effort to isolate the leak, CH-TCV-149 was placed in DIVERT. Due to the elevated pressure at CH-TCV-149 with CH-PCV- 135 fully open, placing CH-TCV-149 in DIVERT coupled with the elevated line pressure created a pressure transient in the letdown line upstream of the CVCS Reactor Coolant Filter. Reactor Coolant Filter Inlet Isolation Valve CH-305 experienced this pressure transient, which resulted in the valve developing a significant leak at the body to bonnet joint. Abnormal Operating Procedure (AOP) 3-AOP-LEAK-1 was entered, and normal letdown was manually isolated to stop the CH-305 leak. Excess letdown was placed in service to balance reactor coolant inventory at a Pressurizer water level of 61 percent.

This exceeded the 54.3 percent limit of Technical Specification 3.4.9 Condition A, and Operations declared the Pressurizer inoperable. The inoperability of the Pressurizer is reportable as a safety system functional failure under 10 CFR 50.73(a)(2)(v). The direct cause of this event was elevated system pressure due to loading of the Reactor Coolant Filter from materials when the 31 Mixed Bed Demineralizer pathway was aligned. The elevated operating pressure in the CVCS letdown stream challenged the integrity of diaphragm valves CH-352 and CH-305, requiring the isolation of normal letdown.

On March 7, 2016, while performing set-up activities for 2-PT-R084C, "23 EDG 8 Hour Load Test," the normal supply breaker to 480 Volt AC Bus (ED) 3A tripped on overcurrent. This caused 480 Volt AC Buses 3A and 6A to de-energize since, as part of the test set-up activities, the tie breaker (3AT6A) between Buses 3A and 6A was closed and the normal supply breaker for Bus 6A was opened. This resulted in a loss of both 21 and 22 Residual Heat Removal (RHR) (BP) pumps. As 'designed, all Emergency Diesel Generators (EDGs) (EK) received automatic initiation signals to start. All required 480 Volt AC buses automatically re-energized by design, with the exception of Bus 3A, which had an overcurrent lockout. Operators manually started 22 RHR pump to restore RHR cooling.

However, prior to restoring the normal supply power to Bus 3A, 23 EDG tripped on overcurrent which resulted in a second loss of RIM event. The cause for the Bus 3A supply breaker tripping was inadequate procedural guidance resulting in excessive loads being energized on Buses 3A and 6A. The direct cause for 23 EDG tripping was cracked solder joints on the automatic voltage regulator (AVR). Corrective actions included revising 2-PT-R084C and replacing the voltage regulator. The event had no effect on public health and safety.

On July 6, 2016,Instrument and Control (I&C) technicians were preparing to perform 2-PT-2M3A (RPS Logic Train B Actuation Logic Test and Tadot). Prior to starting the test, the I&C technicians were unable to locate key #184 that was identified in the test as associated with the reactor trip breaker B bypass key switch. Control Room staff recommended obtaining key #183 associated with reactor trip breaker A bypass key switch to use in lieu of key #184. To ensure the key would work prior to starting the test, the train B bypass key switch was positioned by an I&C technician to the Defeat position. Because reactor trip Bypass Breaker B was in the racked out position, when the key switch was taken to the Defeat position, it caused the normal Reactor Trip Breaker B to open, which initiated a reactor trip (RT) and auxiliary feedwater system actuation. The direct cause was an I&C technician turned the key interlock to defeat on switchgear Channel B Reactor Protection Logic without having the BYB Bypass breaker racked in and closed. The root cause was Indian Point personnel emphasized work culture production goals without fully recognizing the need to maintain fundamental standards and expectations for nuclear workers. Key corrective actions included site all-hands meeting discussing the event, lessons learned, reinforced expectations and the Fleet Refocus Initiative. As an interim action, all essential work that effects generation was required to have direct oversight by a superintendent or above, all work start authorizations provided by operations undergo a work challenge utilizing a new checklist from this event. Complete the actions associated with the Fleet Refocus Observation program. The event had no effect on public health and safety.

Indian Point 2 05000-2'47 APPROVED BY OMB: NO. 3150-0104 EXPIRES: 10/31/2018 comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by Internet e-mail to Note: The Energy Industry Identification System Codes are identified within the brackets (1.

DESCRIPTION OF EVENT

On July 6, 2016,while at 100 percent reactor power, preparations were in progress to commence a scheduled bi-monthly surveillance test in accordance with 2-PT-2M3A (RPS Logic Train B Actuation Logic Test and TADOT (>25% Reactor Power)). The purpose of the surveillance is to perform actuation logic testing of the Reactor Protection System (JC) logic Train B in accordance with Technical Specification (TS) 3.3.1 (Reactor Protection System Instrumentation) Table 3.3.1-1, Function 20, Surveillance Requirement 3.3.1.5. The test had been originally scheduled for June 30, 2016, but due to concerns about Battery Changer 22 grounds, the test was re-scheduled for the following week., At approximately 07:30 hours, on July 6, 2016, a pre-job briefing was held with four I&C technicians and the I&C job Supervisor. Subsequent to the briefing, the I&C technicians went to the Control Room (NA) and informed the Control Room Supervisor (CRS) of the test and what to expect. In the prerequisites section of 2-PT-2M3A, the breaker interlock key number 182, 184 or equivalent was to be obtained from operations prior to commencing the test. At approximately 9:15 hours, I&C personnel determined neither key number 182 nor key number 184 could be found in the Control Room key locker. The CRS suggested that the Train A key number 183 could be used as an equivalent because it was believed that both trains were keyed the same.

Due to concerns with the short Technical Specification (TS) 8-hour Allowed Outage Time (AOT) for the test the I&C technicians wanted to ensure the key would work prior to entering the TS Limiting Condition for Operation (LCO) and starting the test and discussed it with the CRS. The key concerns were discussed with the CRS. After a brief discussion, the I&C technicians believed that Operations gave them permission to test the key prior to starting the surveillance test. Operations believed that the I&C technicians would test the key during the surveillance.

At approximately 9:30 hours, two of the I&C technicians, one operator and two Nuclear Plant Operator (NPOs) took key number 183 (designated for Train A) to the location of the Reactor Trip Breakers (RTBs) (BKR)(Cable Spreading Room) (NA). The 8-hour TS LCO was not entered. Two non-licensed operators (NPOs) were present in the Cable Spreading Room to rack in the bypass breaker when requested by the I&C technicians.

The Field Shift Supervisor (FSS) was also there to inspect cables that were utilized with the Rod Drop Testing during the recent outage. One of the I&C technicians called the Control Room and told another I&C technician, who was staged in the Control Room, that they would receive an annunciator on Panel SK, Window 2-5. The Control Room operator acknowledged the alert of an expected alarm and the I&C technician in the Control Room relayed the acknowledgement to the I&C technician in the Cable Spreading Room containing the RTBs.

comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by intemet e-mail to An I&C technician signaled the other I&C technician that was at the RTBs to test the key. Without using a procedure or an approved work instruction, the other I&C technician positioned the Train B bypass key switch to defeat.. Because reactor trip Bypass Breaker B was in the racked out position, when the train B bypass key switch was taken to the Defeat position, it caused the normal Reactor Trip Breaker B to open, which initiated a reactor trip (RT) at approximately 9:38 hours.

All control rods (AA) fully inserted and all required safety systems functioned properly. The plant was stabilized in hot standby with decay heat being removed by the condenser (SG). The auxiliary feedwater system (BA) actuated as expected due to steam generator low level from shrink effect.

Normally during performance of the test, the train B bypass key switch is only positioned to Defeat after Bypass Breaker B has been closed and the Reactor Trip Breaker B- has been opened. The condition was recorded in the Indian Point Energy Center (IPEC) Corrective Action Program (CAP) in. Condition Report CR-IP2-2016-04320.

The reactor protection system (RPS) (JC) initiates a reactor shutdown, based on values of selected unit parameters, to protect against violating the core fuel design limits and reactor coolant system pressure boundary during anticipated operational occurrences and to assist the Engineered Safety Feature Systems in mitigating accidents. The RPS instrumentation is segmented into four distinct but interconnected modules one of which is reactor trip switchgear that includes the reactor trip breakers (RTBs) and Bypass Breakers. These components provide a means to interrupt power to the control rod drive mechanisms (CRDMs) and allows the rod cluster control assemblies (RCCAs) or rods to fall into the core and shut down the reactor. The bypass breakers allow testing of the RTBs at power. The control rod drive system is designed such that the control rods are held in place and are capable of being moved only when its power supply is energized. Two RTBs placed in series with the control rod drive power supply remain closed as long as their respective under-voltage coils are kept energized by the RPS logic buses. Two bypass breakers are provided to allow in service testing of either RTB. The key-interlock switch is provided such that if both bypass breakers are closed at the same time while racked in, both bypass breakers will be tripped. This interlock is defeated in the test position with the key to allow for tripping of the undervoltage device of the bypass breaker when the reactor is in operation. The key interlock switch at the Reactor Trip Switchgear is placed in the Defeat position to prevent repeated breaker operation as the logics are tripped and reset.

During normal testing of the RPS Logic, the bypass breaker is racked in and closed and the key-interlock switch would then only bring in the alarm in the Control Room supervisory annunciator. For this event the bypass breaker was not racked in (closed).

comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by Internet e-mail to The bypass breakers must be manually closed and under no circumstances should both bypass breakers be racked in and closed at the same time. During normal testing of Channel B, the associated key-interlock switch would have been placed in the defeat position. This would have resulted in: 1) Illuminating a red light on the Train B cabinet, 2) Annunciating an alarm RTB & BYA Train B Defeat on the Control Room supervisory annunciator, 3) Opened up the closing circuit of RTB which is being tested, 4) Opened up the coil circuit of undervoltage trip devices for breakers RTB and BYA which is being tested and preventing the unit from tripping. In this event the key bypass switch was turned to the defeat position while the Bypass Breaker was still racked out (open) which de-energized the undervoltage coil for the B RTB which caused it to open and trip the unit.

An extent of condition (EOC) review determined the condition is bounded to only the RTBs because they are the only breakers with a key-interlocked switch such that if both bypass breakers are closed at the same time while racked in, both bypass breakers will be tripped. The test procedure for unit 2 calls for key number 182, 184 or allows for an equivalent key to be used. This is vague guidance unlike unit 3 which only has one key. The Unit 2 test procedure 2-PT-2M3A will be revised to remove "equivalent.

CAUSE OF EVENT

The direct cause of the RT was due to operating the "B" RPS bypass key out of sequence during Reactor Protection logic testing. An I&C technician turned the key interlock to defeat on switchgear Channel B Reactor Protection Logic without having the BYB Bypass Breaker racked in and closed, which opened the undervoltage tripping device of the RTB and tripped the reactor. The I&C technician turned the key without procedural guidance. The I&C technicians were testing the key with verbal guidance from operations, due to vague procedure guidance in 2-PT-2M3A, that allowed an equivalent key to be used (number 183). Due to not stopping when unsure (conservative decision making), the I&C technicians tested the key prior to starting the surveillance because of perceived time pressure.

The root cause (RC) of the event was that IPEC personnel emphasized work culture production goals for productivity, schedule adherence, and backlog reduction without fully recognizing the need to maintain fundamental standards and expectations for nuclear workers, such as procedure use and adherence and staying in process during work activities. The RC resulted in the I&C technician turning the key without procedure guidance or work instructions and tripped the plant.

CORRECTIVE ACTIONS

The following corrective actions have been or Action Program (CAP) to address the causes of

• Site all-hands meeting was held to discuss to reinforce expectations.

will be performed under the Corrective this event:

the event, the lessons learned, and comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by intemet e-mail to

• discuss the Fleet Refocus Initiative.

• work that effects generation was to have direct oversight by a superintendent or above.

• All work start authorizations provided by operations watch personnel must now undergo an additional work challenge utilizing a checklist developed in response to this event. Revised process was formalized by an Operations Standing Order.

• The completion of corrective actions associated with the Fleet Refocus Observation Program will be documented to ensure all personnel apply the essential knowledge, skills, behaviors and practices needed to conduct work safely and reliably.

• Procedures 2-PT-2M3, 2-PT-2M2, and 2-PT-2M2A will be revised to remove the word "equivalent" to prevent any questions on which key to use.

EVENT ANALYSIS

The event is reportable under 10CFR50.73(a)(2)(iv)(A). The licensee shall report any event or condition that resulted in manual or automatic actuation of any of the systems listed under 10CFR50.73(a)(2)(iv)(B). Systems to which the requirements of 10CFR50.73(a)(2)(iv)(A) apply for this event include the Reactor Protection System including reactor trip and AFWS actuation. This event meets the reporting criteria because an automatic reactor trip was initiated at 9:38 hours, on July 6, 2016, and the AFWS actuated as a result of the RT. On July 6, 2016, at 13:16 hours, a four hour non-emergency notification was made to the NRC (Log Number 52067) for an automatic reactor trip while critical and included the eight hour non-emergency notification for the actuation of the AFW system. Both notifications were in accordance with 10CFR50.72(b)(3)(iv)(1). The event was recorded in the Indian Point Energy Center corrective action program (CAP) as CR-IP2-2016-04320.

As all primary safety systems functioned properly there was no safety system functional failure reportable under 10CFR50.73(a)(2)(v).

PAST SIMILAR EVENTS

A review was performed of the past three years of Licensee Event Reports (LERs) for events that involved a reactor trip due to testing of the reactor protection system.

No applicable LERs were identified.

SAFETY SIGNIFICANCE

This event had no effect on the health and safety of the public.

This condition had no effect on the health and safety of the public.

There were no actual safety consequences for the event because the event was an uncomplicated reactor trip with no other transients or accidents.

• Small Group Meetings.

• from the Fleet Refocus Initiative.

Site All-hands meeting was held to Conducted Fleet Refocus Initiative Implemented observation activities As an interim action all essential comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by intemet e-mail to Required primary safety systems performed as designed when the RT was initiated. The AFWS actuation was an expected reaction as a result of low SG water level due to SG void fraction (shrink), which occurs after a RT and main steam back pressure as a result of the rapid reduction of steam flow due to turbine control valve closure.

For this RT there was no actual condition to initiate the reactor trip breaker opening. Event was initiated by human error.

There were no significant potential safety consequences of this event. The RPS is designed to actuate .a RT for any anticipated combination of plant conditions to include low SG level. All components in the RCS were designed to withstand the effects of cyclic loads due to reactor system temperature and pressure changes. The reactor trip breakers (RTBs) are in the electrical power supply line from the control rod drive motor generator set power supply to the CRDMs. Opening of the RTBs interrupts power to the CRDMs, which allows the shutdown rods to fall into the core by gravity. Each reactor trip breaker (RTB) is equipped with a reactor trip bypass breaker (RTBB) to allow testing of the trip breaker while the unit is at power. Each RTB and RTBB is equipped with an undervoltage coil and a shunt trip coil to trip the breaker open when needed. The reactor trip signals generated by the RPS automatic trip logic cause the RTBs and associated RTBB to open and shut down the reactor.

There are two RTBs in series so that opening either will interrupt power to the rod control system and allow the control rods to fall into the core and shut down the reactor. Each RTB has a parallel RTBB that is normally open. This feature allows testing of the RTBs at power. A trip signal from RPS logic train A will trip RTB A and RTBB B; and a trip signal from logic train B will trip RTB B and RTBB A. During normal operation, both RTBs are closed and both RTBBs are open. When any one train is taken out of service for testing, the other train is capable of providing unit monitoring and protection until the testing has been completed.

For this event, rod control was in automatic and all rods inserted upon initiation of a RT. The AFWS actuated and provided required FW flow to-the SGs. RCS pressure remained below the set point for pressurizer PORV or code safety valve operation and above the set point for automatic safety injection actuation. Following the RT, the plant was stabilized in hot standby.

Indian Point 2 05000-247

On July 8,2015, during surveillance testing, the Control Room received a 6.9kV motor trip alarm due to 31 Condensate Pump (CP) Motor circuit breaker trip on overcurrent. .

Operators entered Alarm Operating Procedure 3-A0P-FW-1 due to loss of the 31 CP and initiated a load reduction. During this time the Main Boiler Feedwater Pump (MBFP) suction pressure decreased to its suction pressure cutback controller pressure range and its output decreased MBFP speed control to a minimum. The 31 MBFP speed control signal locked in at this minimum speed signal due to actuation of the MBFP Lovejoy speed control system Track and Hold feature. Due to this minimum 31 MBFP condition, the 31 MBFP , recirculation valve opened causing the 31 MBFP check valve to close. With the 31 MBFP unloaded, Steam Generator (SG) water levels decreased and at 15 percent operators manually tripped the reactor. The Auxiliary Feedwater System automatically started as expected due to SG low level from shrink effect. Direct cause was the 31 MBFP entered a Hold condition erroneously due to a miss-wired Track and Hold board in the speed control system. The root cause was the procurement for the MBFP Lovejoy Track and Hold boards was at an insufficient quality level commensurate with its criticality. There was a failure to mandate functional testing and wiring verification requirements on the vendor to ensure the procurement of a quality product. Corrective actions included replacement of MBFP track and hold board and 31 CP motor. A new replacement Track and Hold circuit board for both the 31 and 32 MBFP speed control system with the miss-wiring corrected was installed. The quality levels for the Track and Hold boards were revised from Q4 to Q3.

MBFP Lovejoy speed control maintenance procedures and site vendor manuals were revised to include more detail. The event had no effect on public health and safety.

FACILITY NAME (1) DOCKET (2) LER NUMBER (6) PAGE (3)

On June 20, 2016, Entergy management was advised by the NRC that during a tour in containment while the unit was in Mode 4, the inspector identified two open barrier gates for the Emergency Core Cooling System (ECCS) sump.

Personnel were moving scaffolding from inside the crane wall to areas outside the crane wall through the two open barrier gates. Having both sump barrier gates open violated ECCS operability basis which requires the sump barrier system to be operable in Modes 1-4.

The inspector notified the operator touring with him of the observation. The operator subsequently coached the Radiation Protection (RP) door guard to ensure that one of the gates be closed at all times. The apparent cause was a latent organizational weakness associated with the use of procedure OAP-007 (Containment Entry and Egress) which had not been communicated well within the organization.

The failure mode was personnel not being aware of all available information.

The scaffold supervisor was not aware of his requirement to serve as containment coordinator and provide the required briefing on gate closure. The RP brief was focused on the locked high radiation requirements not gate control. Corrective actions included closing and securing one gate, briefing RP personnel on the event, the lessons learned and management expectations. This event will be included in all 3R19 supplemental supervisors qualifications required reading list. Procedure OAP- 007 will be revised to include a checklist for entry briefings to include GS-191 requirements. The event had no significant effect on public health and safety.

Indian Point 2 05000-247 APPROVED BY OMB: NO. 3150-0104 EXPIRES: 10/31/2018 comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by intemet e-mail to Note: The Energy Industry Identification System Codes are identified within the brackets ().

DESCRIPTION OF EVENT

On June 20, 2016, Indian Point management was advised by the NRC that during a tour in containment (NH) while the unit was in Mode 4, the inspector identified two open barrier gates for the Emergency Core Cooling System (ECCS) (BQ) sump. Personnel were removing disassembled scaffolding from inside the crane wall on the 46 foot elevation of containment and moving it through the ECCS sump barrier gates (GATE) to areas outside the crane wall through the two open barrier gates. Having both sump barrier gates open violated ECCS operability basis which requires the sump barrier system to be operable in Modes 1-4. The plant had entered Mode 4 on July 10, 2016, at 23:30 hours. The inspector notified the operator touring with him of the observation. The operator subsequently coached the Radiation Protection (RP) door guard to ensure that one of the gates were closed at all times. No condition report recorded the event at the time. Subsequently, on June 20, 2016, after an NRC inspector advised a site manager the condition was recorded in the Indian Point Energy Center (IPEC) Corrective Action Program (CAP) as Condition Report CR-IP2- 2016-04036. On June 21, 2016, CR-IP2-2016-04037 recorded the failure to initiate a CR at the time of the event.

For postulated breaks in the Reactor Coolant System (RCS) (AB) there are two recirculation related sumps within the containment, 1) the Recirculation Sump and, 2) the Containment Sump. Both sumps collect liquids discharged into the containment during a design basis accident. As part of the resolution of Generic Safety Issue (GSI)-191 (Assessment of Debris Accumulation on PWR Sump Performance) and Generic Letter 2004-02 (Potential Impact of Debris Blockage on Emergency Recirculation During Design Basis Accidents at Pressurized Water Reactors) various flow barrier debris interceptors were installed in the containment to channel the recirculation flow into the reactor cavity sump area, up and out of the Incore Instrumentation Tunnel, through the crane wall and containment sump labyrinth wall via specially designed openings, and into the annulus area outside the crane wall.

The recirculation flow will migrate towards the Recirculation Sump or the Containment Sump depending on which pump(s) are operating. Flow channeling barriers are installed on the Reactor Cavity Sump around the Incore Instrumentation Tunnel, on the Recirculation Sump trenches, and at the Containment Sump. Flow channeling barrier gates are installed in the northeast and northwest quadrant openings of the Crane Wall. In addition, flow channeling barrier gates are installed in the north and south entrances to the Recirculation Sump area. There is one dual access gate (gates 17 and 23) to allow access without violating the flow barrier integrity during transient through the flow barrier system.

comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by intemet e-mail to Investigation of the event determined that the scaffold work group was the largest group within containment during the time the scaffold job on the 46 foot elevation was being worked. In accordance with procedure OAP-007 (Containment Entry and Egress) the scaffold group was to assume the role of containment coordinator and be responsible for performing a containment entry briefing. However, instead of providing a containment entry briefing, a regular or standard HU pre-job brief was given to the scaffold workers by their contractor supervisor. Because the area being worked was a radiation controlled area the scaffold workers then met with Radiation Protection (RP) personnel at the Health Physics access (HP1) for a Locked High Radiation Area (LHRA) RP pre-job brief. The RP brief included discussion that one of the ECCS barrier gates had to be closed at all times per GSI-191 and OAP-007 requirements. The job also required an RP door guard whose only function was to ensure that anyone entering into the inside crane wall had to have an HP individual with them. There was no ECCS barrier gate monitor assignment as required by OAP- 007. As work progressed the scaffold workers left both ECCS barrier gates open to enhance removal of scaffold material to storage. Although the scaffold workers were told during the RP briefing that one ECCS barrier gate must remain closed at all times, it was discovered in interviews with workers that they thought that none of the other gates could be opened while they were using their gate location to remove scaffold.

It was determined that the supplemental scaffold supervisor was not aware of a specific entry procedure that was required to be used prior to a containment entry.

A specific OAP-007 procedure containment entry brief was not given to the workers nor were they and their supervisor aware of the procedure. The supplemental scaffold group supervisor stated that in previous containment entries he and his group were never the main group going into containment so they were always briefed by operations or RP and didn't recall using OAP-007. Procedure OAP-007 is specifically written to cover many aspects of containment entries. The procedure contains sections and steps discussing the ECCS barrier gates with diagrams of the crane wall and all of the gates with their locations and numbers. If the procedure had been used in addition to a pre-job and RP brief, the requirements would have been clearer to the workers and this event most likely would not have occurred.

An extent of condition (EOC) review was performed and it determined that both units are similar and both would be vulnerable in an event if there was a direct flow path for accident debris to enter the containment/internal recirculation sump. The condition is bounded by the crane wall gates as these are the only types of gates in the containment installed in the crane wall that protect the ECCS sumps from debris.

comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by intemet e-mail to

CAUSE OF EVENT

The apparent cause was a latent organizational weakness associated with the use of procedure OAP-007 (Containment Entry and Egress) which had not been communicated well within the organization. The failure mode was personnel not being aware of all available information. The scaffold supervisor was not aware of his requirement to serve as containment coordinator and provide the required briefing on gate closure. The RP brief was focused on the locked high radiation requirements not gate control.

CORRECTIVE ACTIONS

The following corrective actions have been or will be performed under the Corrective Action Program (CAP) to address the causes of this event:

• Dual gates were closed and applicable gate secured. The RP door guard was coached on requirement to have at least one gate closed and secured at all times.

• A HU meeting was held and interviews conducted with the work crew, supervisor and RP personnel and the requirements of OAP-007 were reviewed and requirements of the ECCS barrier reinforced.

• A Department Clock Reset/Yellow memo was prepared and the lessons learned on the event and management expectations communicated with Projects organizations, all site departments, and the Fleet.

• The event will be included in all 3R19 supplemental supervisors qualifications required reading list.

• Procedure OAP-007 will be revised to include a checklist for entry briefings to include GS-191 requirements.

EVENT ANALYSIS

The event is reportable under 10CFR50.73(a)(2)(v)(D) as a safety system functional failure as the condition could have prevented adequate post accident core cooling due to DBA debris blockage of the recirculation and/or the containment sump. An ECCS train is inoperable if it is not capable of delivering design flow to the RCS.

Individual components are inoperable if they are not capable of performing their design function or supporting systems are not available. Technical Specification (TS) 3.5.2 (ECCS-Operating) requires three ECCS trains to be operable in Modes 1, 2 and 3, and TS 3.5.3 (ECCS-Shutdown) requires one ECCS residual heat removal (RHR) subsystem and one ECCS recirculation subsystem to be operable in Mode 4.

comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by intemet e-mail to Indian Point 2 05000-247 The licensing and design basis of the ECCS per UFSAR Section 6.2.2 (ECCS System Design and Operation) credits flow channeling barriers installed in containment in response to the resolution of GL-2004-02. The two flow barrier gates that were used for removing scaffolding were not closed and secured to prevent it from being forced open during a DBA. The unsecured gates were not in accordance with design and not a sufficient robust barrier to prevent debris from entering the recirculation and containment sumps had a DBA occurred while in Mode 4. The condition is also reportable under 10CFR50.73(a)(2)(vii) (common cause inoperability of independent trains or channels) as the condition caused at least one independent train or channel to become inoperable in multiple systems or two independent trains or channels to become inoperable in a single system designed to (D) mitigate the consequences of an accident. The NRC inspector tour occurred during the time the unit was in Mode 4. The unit entered Mode 4 on June 10, 2016, at 23:30 hours. However, no CR was initiated for this condition at that time. CR- IP2-2016-04037 recorded that condition that while performing a walkdown with an NRC inspector on June 11, 2016, the NRC raised a question about an activity in the field and no condition report was initiated.

PAST SIMILAR EVENTS

A review was performed of the past three years of Licensee Event Reports (LERs) for events that involved SSFFs and/or common cause inoperability of an Engineered Safety Feature System that had a similar cause. No LERs were identified at Unit 2.

A review of all reported events during the past three years at both units identified one LER at Unit 3 that was similar. Unit 3 LER-2013-002 reported on April 29, 2013, a Safety System Functional Failure and Common Cause Inoperability of the Emergency Core Cooling System due to violation of containment sump debris barrier integrity. The LER reported that on March 4, 2013, during shutdown for a refueling outage, Radiation Protection (RP) personnel entered the reactor containment building to install plastic RP fencing for the Reactor Coolant Drain Tank (RCDT). After receiving clearance at Mode 4 to enter the Inner Crane Wall (ICW) to install fencing around the RCDT and post it as a Locked High Radiation Area (LHRA). The RP work crew assumed they could enter the ICW area through any sump barrier gate for the Emergency Core Cooling System (ECCS). The RP work crew chose to use a single gate access point due to its proximity to the RCDT.

Subsequently, a RP Technician identified that personnel had not entered the area using the double access gate and had brought in plastic fencing which was inappropriate material for the sump area. The apparent causes were an inadequate pre-job brief and inadequate procedure for Containment Entry and Egress (OAP-007, 0-RP-RWP-405) due to poor change management. The pre-job brief failed to cover the requirement to use the dual sump barrier gate access point when in Modes 1-4, nor did it address the type of fencing allowed. Corrective actions included revision of Procedure OAP-007 to clearly state that within the procedure's attachments that only the sump barrier dual access gate for 46 foot Containment ICW entries shall be used in Modes 1-4.

comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by intemet e-mail to The revision specified the use of the double entry gate and that one gate is to remain shut and secured at all times. Securing the gates at unit 3 which uses a slide latch does not state the use of a gate monitor. The step for Unit 2 includes statements that the gates be secured with a padlock or nut and bolt closure from the outside. This condition requires posting of a gate monitor to allow exit.

SAFETY SIGNIFICANCE

This event had no significant effect on the health and safety of the public. There were no actual safety consequences for the event because there were no accidents or transients during the time of the event. The analysis performed in response to GL- 2004-02 included debris transport analysis conservatisms for transport of debris to both the IR sump and the Containment sump in excess of quantities that would be generated. Establishing normal RHR cooling to the RCS has RCS temperature below 350 degrees F and pressure less than 400 psig.

In Mode 4 the reactor is not critical and reactivity is stable. In Mode 4 there is significantly less energy in the RCS to generate debris. At the time the actual RCS pressure (pressurizer pressure) was approximately 355 psig. An evaluation of a LOCA during Mode 3 and 4 operation was performed by Westinghouse (WCAP-12476) that showed a direct reduction in break probability for Mode 4. The evaluation concluded that Mode 4 LOCAs are not a significant contributor to shutdown risk.

During this event the entire flow barrier was not disabled because only two debris barrier gates were unsecured and only for the time scaffold workers were allowed to perform assigned work. The exact time the gates were open cannot be determined as the barrier gates have no electronic timing devises. However, the scaffold workers were assigned three entries with stay time limitations for heat stress of 45 minutes each for a total job time of 135 minutes. The scaffold work assignment took place in Mode 4. The unit entered Mode 4 on June 10, 2016, at 23:30 hours.

For the first two of three entries, the scaffold workers had to go inside the crane wall and disassemble erected scaffolding. Per the scaffold supervisor at least one door was closed during scaffold disassembly. Therefore approximately 60 minutes were left for moving disassembled scaffolding from inside the crane wall through the open gates to the outside crane wall storage areas. Therefore most debris would have been intercepted by the flow barrier system. Also, the barrier gates swing into the crane wall so that DBA flow and forces would tend to close the gate when pressure is applied (e.g., DBA debris loads) therefore limit flow barrier bypass and sump debris loading.

On March 26, 2016, during a refueling outage, an NRC inspector identified that the trip of the MBFPs is not tested in accordance with Technical Specification 3.7.3 (Main Feedwater System) Surveillance Requirement (SR) 3.7.3.3.

This was discovered as a result of an assessment of the failure of the Main Boiler Feedwater Pumps (MBFPs) steam stop valves to close after the reactor trip on December 5, 2015.

• TS SR 3.7.3.3 requires testing the MBFP trip function every 24 months on an actual or simulated actuation signal.

Surveillance tests 2-PT-V024DS60 .and 2-PT-V24DS61 are performed every 24 months, but only test up to the limit switch contact that actuates the MBFP turbine.trip solenoid valves and does not include the trip of the pump. A review determined the requirement to verify the trip of the MBFPs was added to the TS during the implementation of the improved TS (ITS) conversion program in 2004 but the corresponding testing was not added to the surveillance tests.

The direct cause was human error for failure to ensure testing was established to meet new ITS„SRs. The apparent cause of the error is indeterminate due to the time passed since TS conversion by Amendment 238 on November 21, 2003. Corrective actions include revision of Surveillance tests 2-PT-V024DS60 and 2-PT-V24DS61 to test tripping of the MBFPs. The MBFPs will be tested per the revised procedures prior to startup from the. outage. The event had no significant effect on public health and safety.

On March 4, 2016, during the performance of surveillance procedure 2-PT-R006, Main Steam Safety Valve (MSSV) MS-45B failed to lift within the Technical Specification (TS) as- ' found required range of +/- 3% of the setpoint pressure. Valve MS-45B lifted at 1125 psig, 29 psig outside its acceptance range of 1034 to 1096 psig and 5.7% above its 1065 psig setpoint. The valve was declared inoperable, then subsequently restored to operability upon two successful lifts within the required setpoint range without the need for adjustment. Nine other MSSVs that were tested lifted within the as-found required setpoint range. The apparent cause for the failure was internal friction due to spindle rod wear, which causes the spindle rod to bind against internal components.

Corrective actions were modification of MS-45B and twelve other MSSVs, and the replacement of their spindle rods. The event had no effect on public health and safety.

On December 5, 2015, control room operators initiated a manual reactor trip (RT) after observing indications consistent with multiple dropped control rods (CR) following an alarm for the trip of Motor Control Center (MCC)-24/24A. No Control Rod indication was available due to MCC-24 being de-energized. All primary safety systems functioned properly except the primary rod control cabinet power supply (PS1) which was in a degraded condition prior to the event and failed to function as required. The plant was stabilized in hot standby. There was no radiation release. The Auxiliary FW system automatically started as designed. The direct cause of the event was loss of MCC-24 due to an internal fault at the line side leads at cubicle 2H where they connect to the bucket stab assemblies (load side fault). This caused the supply breaker feed to open per design and clear the fault. The de-energization of MCC-24 removed the functioning backup Control Rod (CR) power supply and the remaining degraded primary power supply failed to function as required. The apparent cause was an unanticipated loss of power to the CR system due to the degradation of the primary CR power supply (PS1) which failed to function when the operating power supply (PS2) was lost. MCC-24/24A was lost due to a design error that allowed the positioning of a mounting plate too'close and obstructing the line side wiring resulting in contact. Vibration over time resulted in degraded wiring insulation which eventually shorted. Corrective actions included inspection and testing of the MCC-24 bus and control wiring. The degraded Rod Contrl power supply (PS1) was replaced. Maintenance procedures will be revised to provide more in-depth inspection criteria. The event had no effect on public health and safety.

FACILITY NAME (1) PAGE (3) DOCKET (2) LER NUMBER (6)

On February 27, 2015, during the performance of surveillance procedure 3-PT-R006A, three main steam safety valves (MSSV) (MS-46-2, MS-45-4 and MS-47-4) failed their As-Found lift.

set point test. Per the test, these valves must lift at +/- 30 of their required setting.

During the test, 7 other MSSVs tested passed their As-Found test criteria.

Technical Specification (TS) 3.7.1 (Main Steam Safety Valves) requires the MSSVs to be operable in accordance with TS Table 3.7.1-1 and Table 3.7.1-2.

Due to the number of failures, during power ascension the remaining MSSVs were tested and two failed (MS-46-2, MS-46-3).

MSSV MS-46-2 had previously failed and had maintenance performed therefore the failure was considered a post maintenance test failure.

MS-46-3 failed its first lift test by 0.60 but met test lift criteria on the second and third test.

TS Surveillance Requirement (SR) 3.7.1.1 requires each MSSV be verified to lift per Table 3.7.1-2 in accordance with the In-service Testing Program. Operability of the MSSVs includes the ability to open within the set point tolerances. The direct cause of the failure of these valves was severely worn spindle rods.

The apparent cause for the failure of MS-47-4 and MS-46-2 was internal friction due to spindle vibration.

The apparent cause of the failure of.MS-45-4 was reuse of a worn spindle. The apparent cause of the failure of MS-46-3 is foreign material.

Corrective actions included testing all 20 MSSVs and adjusting their set point to be within +/- 1% of design set pressure. Installed new spindles and bronze wear sleeves on valves MS-46-4, MS-46-2, MS-47-4, MS-48-2, MS-49-2, MS-49-1, MS-49-3, and replaced the spindle on valve MS-45-4. The Unit 3 MSSV test frequency will be changed from 4 years to 2 years until all modifications are implemented and IPEC is confident the issue is resolved. The event had no effect on public health and safety.

FACILITY NAME (1) DOCKET (2) LER NUMBER (6) PAGE (3)

On January 8, 2015, the Refueling Water Storage Tank (RWST) level sensing instrumentation lines (LT-920 and LIC-921) were discovered frozen resulting in inoperable low-low level alarms in the Control Room. Entered Technical Specification (TS) 3.5.4 (RWST) Condition C due to both RWST low-low level alarms disabled in the CR.

TS Condition C requires at least one channel of RWST low-low level to be restored to operable in one hour. Actions initiated to return one RWST level channel to operable..

Entered TS 3.5.4 Condition D (Required Action and associated Completion Time not met) D.1 be in. Mode 3 in 6 hours and D.2 be in Mode 4 in 12 hours. Commenced unit shutdown per TS for inoperable RWST level alarms. Repairs and calibrations completed returning the RWST level alarms to operable. TS 3.5.4 exited and power ascension commenced. Loss . of-both LT alarms is a safety system functional failure as the alarms are credited for operator manual switchover for recirculation. Direct cause was failure of the RWST instrument level alarm strip heater to maintain the temperature in the instrument enclosure. - Due to the failure of the heat trace circuit EHT34-1 strip heater to . function combined with a period of severe cold weather resulted in the sensing lines for the RWST.to freeze. The apparent cause was a high resistance electrical connection at the strip heater wire lug due to thermal cycling and age. Corrective actions included _repair of ring lug to strip heater and calibration of level instrumentation.

Maintenance procedure 0-ELC-419-EHT will be revised to include inspection/repair of -. strip heater and ring lug connections within instrument enclosures. An action request (AR) will be initiated for a new model Work Order/PM to inspect strip heater connections and-operation. The event had no significant effect on public health and safety.

On February 24, 2014, during initial Containment walkdowns after shutdown for a refueling outage, Operations identified a steam leak on 23 steam generator (SG) drain line valve MS-68. Valve MS-68 is a normally closed valve on a one inch drain pipe from the 23 SG shell side to the two inch SG Blowdown piping to the blowdown tank.

The steam leak was due to a through wall defect in the valve body. The one inch SG drain pipe and valve MS-68 are safety related, ISI-ASME Code Class 2 High Energy (HE) and Seismic Class 1 components. Assessment of the condition determined the leak could not be isolated and Ultrasonic Testing (UT) could not be performed to determine the extent of the defect. The valve and associated piping are a pressure boundary for the SG and because there is no ASME Code method to evaluate the structural integrity of the through wall defect, Engineering concluded the valve was inoperable. Operations declared the 23 SG inoperable but the plant was in Mode 5 (Cold Shutdown) and one SG inoperable did not impact Technical Specification (TS) 3.4.7 (Reactor Coolant System (RCS) Loops-Mode 5, Loops Filled). However, the condition had resulted in leaking prior to shutdown and therefore was applicable to TS 3.4.4 (Reactor Coolant System (RCS) Loops-Modes 1 and 2) which requires four operable RCS loops including four operable SGs. The cause of the steam leak was a pin hole in the body of valve MS-68.

The pin hole was likely a defect in the original valve casting which over time propagated through the valve wall. Corrective action was removal and replacement of the valve. The event had no effect on public health and safety.

On February 13, 2013, operators initiated a manual reactor trip (RT) as a result of lowering steam generator (SG) levels. All control rods fully inserted and all required safety systems functioned properly.

The plant was stabilized in hot standby with decay heat being removed by the main condenser (SG).

The Auxiliary Feedwater System automatically started as expected due to SG low level from shrink effect.

An investigation determined the decreasing SG levels was due to reduced main feedwater (FW) flow from a loss of Heater Drain Tank (HDT) pumps. The HDT pumps tripped during valve diagnostics on HDT level control valve LCV-1127B which resulted in HDT Large Dump valves failing open. The open HDT large dump valves resulted in low HDT level and trip of the HDT pumps. The HDT large Dump valves failed open when the current/pressure (I/P) lead was lifted during air operated valve (AOV) diagnostics per procedure 0-IC- PC-AOV. Loss of HDT flow to the main feedwater pumps (FWPs) caused the FWPs speed controller cutback to reduce FW flow to the SGs. The root cause (RC) was inadequate procedure design and content. Corrective actions from the RC will be to revise Maintenance procedures 0-IC-PC-AOV and 0-VLV-404-AOV to: 1) Eliminate conditional steps for equipment setup that allows changes to work scope to be made in the field without proper review prior to performing work, 2) Eliminate the subject Caution block, and 3) Include signature blocks for review of drawings and validation that lifting a I/P lead or disconnecting the instrument tubing will not affect any other valve or component.

The event had no effect on public health and safety.

On September 7, 3.8.7 Condition A was entered for an 2012, Technical Specification (TS) inoperable 22 Static Inverter (SI) after the 22 SI swapped to its alternate power source.

Troubleshooting determined the SI frequency meter optical sensor light was out.T Tapping on the meter resulted in the frequency meter light illuminating allowing SI.to sense that the correct frequency was present.T After testing, operations transferred the 22 SI back to its normal power supply and exited TS 3.8.7.T On September 10, 2012, operability of the 22 SI was questioned concerning the 22 SI seismic qualification.TBecause the cause of the failure of frequency meter could not be determined, operations concluded there was no reasonable assurance that the 22 SI would be able to maintain its design function in the event of a seismic event and the 22 SI was declared inoperable. the TS 3.8.7 was entered,T meter was replaced and the 22 SI returned to its normal power supply. The apparent cause was inadequate use of human performance (HP) tools.T Shift management did not effectively use questioning attitude.T The Operations team level of knowledge on the operation of the optical sensor was insufficient to assess the seismic effect on its operation.T Corrective actions included replacement of 22 SI frequency meter, inclusion of event in operations training, and update of vendor manual on meter function.T The System Description for electrical systems will be revised to include a discussion of SI frequency meter optical sensor, a Temp Mod had been installed for the 24 SI and was issued for the 21-23 SIs to bypass the out of frequency transfer.T A mod will be prepared to replace the meters with a model that does not include transfer on out of frequency.T An equipment failure analysis will be performed to determine the cause of the failure of the 22 SI frequency meter photocell LED.T The event had no significant effect on public health and safety.

On November 7, 2010, an automatic reactor trip (RT) was initiated as a result of a turbine-generator trip due to actuation of the main generator primary and back-up lockout relays. All control rods fully inserted and all primary systems functioned per design except for the 138 kV Station Auxiliary Transformer tap changer. The plant was stabilized in hot standby with decay heat being removed by the main condenser (SG). Based on reports of two explosions an Alert was declared in accordance with the emergency plan which was terminated at 22:18 hours. There was no radiation release. The Emergency Diesel Generators did not start as offsite power remained available. The Auxiliary Feedwater System automatically started as expected due to SG low level from shrink effect. The direct cause of the RT was due to actuation of the 86P and 86BU relays that sensed a fault from the failure of 21 main transformer (MT) as a result of a low impedance fault of the 345 kV Phase B bushing. The root cause was an internal failure of the phase B bushing due to a vendor design/manufacturing deficiency.

Corrective actions include replacement and acceptance testing of the 21 MT, external visual inspections of the 22 MT HV bushings, Unit Auxiliary Transformer (UAT), Iso-phase bus and 345 kV feeder W95, testing of the 22 MT, UAT, Iso-phase bus and HV components. Damaged HV components were replaced. The bushings for the 21 and 22 MT were replaced with another manufacturers bushing. The event had no effect on public health and safety.

On March 1, 2011, Emergency Diesel Generators (EDGs) 21, 22' and 23 automatically actuated as a result of undervoltage on 480 Volt buses 5A and 6A due to a loss of 138 kV offsite power. 480 volt buses 2A and 3A remained energized as 6.9 kV buses 2, and 3 were energized from the Unit Auxiliary Transformer (UAT) which is connected to the Main Generator. All EDGs operated as designed. EDGs 21 and 23 were manually loaded onto buses 5A and 6A. Prior to the event Con Edison personnel were performing troubleshooting in the Buchanan switchyard on a metering circuit for 138 kV feeder 95332.

The direct cause was loss of power to 480 volt safeguards buses 5A and 6A due to isolation of 138 kV feeder 95332 to the Station Auxiliary Transformer.

Feeder 95332 isolated as a result of an arc on the feeder metering circuit current transformer (CT) switch that caused an imbalance.

The CT circuit also supplies the first line pilot wire relay which tripped due to the imbalance. In accordance with design, the pilot wire relay tripped 138 kV breakers F2 and BT3-4 in the Buchanan switchyard and actuated protective relay 87L/138 which actuated lockout relay 86 STP tripping unit 2 breakers BT4-5 and 6.9 kV breakers 52/ST5 and 52/ST6 thereby isolating feeder 95332.

The apparent cause was a failure of the current transformer (CT) test switch associated with the 138 kV feeder metering circuit to make- before-break. The test switch did not make-before-break due to corrosion on the contact surfaces. Corrective actions include closure of the test switch and restoring feeder 95332 to service. A Con Edison deficiency tag was placed on the switch. Troubleshooting was performed on the Buchanan switchyard feeder 95332 CT circuit and the test switch replaced. Con Edison revised their notification procedure for work impacting the switchyard. The event had no significant effect on public health and safety.

On October 3, 2011, during performance of the quarterly surveillance test of the Containment Fan Cooler Unit (FCU) cooling water flow, all five FCUs failed to meet minimum flow requirements with the essential service water (SW) header (1/2/3 header) supplied by the 22 and 23 SW pumps. Operations entered Technical Specification (TS) 3.0.3 per TS 3.6.6.F for 3 trains of FCUs inoperable. In accordance with TS 3.0.3 operations initiated actions to place the plant in Mode 3 within 7 hours. Operations initiated turbine load reduction by approximately 5 MW and swap of the essential SW supply to the 4/5/6 header.

Upon completion of the essential header swap, operations re-performed the quarterly surveillance test on the 4/5/6 header with satisfactory results. Based on successful completion of the test, Operations exited the TS 3.0.3 action statement and commenced power ascension to 100% power. The direct cause was excessive accumulation of silt in the SW Bay that resulted in degraded inlet flow to the SW pumps. The root cause was ineffective barriers established to monitor and remove silt accumulations that would affect SW pump Net Positive Suction Head (NPSH) margin failed to include predictive elements that account for changing environmental conditions. Corrective actions included sonar mapping and de-silting of the SW Bay. The sonar mapping frequency will be increased and the SW System Monitoring Plan will be revised to include alert and action levels for silt buildup. A comprehensive silt monitoring and mitigation plan will be developed to include predictive trending and monitoring methods. The event had no significant effect on public health and safety.

On November 12, 2010, during performance of the quarterly functional test of the 32 Containment Spray Pump (CSP) the supply breaker failed to close. The breaker was fully charged and there were no abnormal indications. A second attempt to close the breaker failed and the breaker was racked out and visually inspected with no anomalies identified with the breaker or cubicle. A test of the close circuit was satisfactory and the breaker and cubicle secondary contacts were cleaned and inspected. With the breaker in the test position it operated successfully, but when racked into the connect position it failed to close. The trip circuit was verified to operate. The breaker problem was isolated to the close circuit. With the breaker racked in and charged, the fuses were removed and the control switch was positioned to close while measuring continuity across the closing circuit. With the breaker in the test position all indications were as required. With the breaker in the connect position, an open circuit was measured. Measurements and contact alignment inspections were performed with no problems identified. The breaker was replaced with a spare breaker and the quarterly test successfully performed. The direct cause was the breaker closing circuit was not reset to allow breaker closure. The apparent cause was a malfunction in the breaker closing circuit resulting in an open circuit. Engineering's review of a vendor equipment failure evaluation (EFE) concluded the breaker failed to close due to a high contact resistance of the motor cutoff switch.

Corrective actions include breaker replacement and revision of the Preventive Maintenance procedure to include resistance testing of the motor cutoff switch contacts. The event had no significant effect on public health and safety.

On September 1, 2010, during performance of 2-PT-Q017C (Alternate Safe Shutdown Supply Verification to 23 CCP), the Reactor Coolant System (RCS) Wide Range Hot Leg Temperature Instruments TI-5139Tand TI-5141 test readings were found out of (Loop 21) (Loop 22) specification. (Remote Shutdown), T Technical Specification Basis 3.3.4 Table 3.3.4-1, Function 3.b Decay Heat Removal via Steam Generators, RCS Hot Leg (HL) Temperature requires one operable function. The RCS HL Temperature is also credited in Technical Requirements Manual (TRM) 3.3.D (Appendix R Alternate Safe Shutdown Instrumentation).

After verification of proper performance of the test, Operations concluded the function for RCS HL Temperature was inoperable and entered TS 3.3.4 Action Statement A.1.

The apparent cause was indeterminate.

T A Failure Modes and Effect Analysis identified two possible causes: PC-1) A test process failure. The test has had historical problems with the test sequence where the instruments are powered prior to start of the 23 CCP and starting currents impacted instrument readout. Also the instruments and circuit is required to warm up and stabilize after establishing power.

T To mitigate these effects the test was revised. PC-2)TT A complete failure of the R/I converter Component failure.T (TM) could cause the condition but a successful re-test and calibration ruled out a complete failure. Corrective actions include re-performing test 2-PT-Q017C with engineering review, and evaluating re-test results and identifying any additional actions.TThe event had no effect on public health and safety.

On September 17, 2009, during performance of surveillance 3-PT-Q87D (Channel Functional Test of Reactor Coolant Temperature Channel 441) bistable 3TC-441C/D As-Found test readings were identified as out of specification for the Over Power Delta Temperature (OPDT) reactor trip function.

The bistable was adjusted in accordance with the procedure and all readings were left in specification.

T An'assessment of the condition determined that bistable 3TC-441C/D had been found out of specification on the previous quarterly surveillance on June 26, 2009.T (Reactor Protection Technical Specification 3.3.1T delta Temperature span, which for bistable TC-441C/D correlates to a 0.144 Volts DC T (Vdc) deviation from the nominal value. The OPDT Trip test criteria is 6.60 T(6.56 to 6.64) Vdc. On The As-Found OPDT value was 6.86 Vdc which exceeded the TS allowed value.

October 6, 2009, engineering concluded the second failure can not be assumed to have occurred at the time of discovery and represented an inoperable condition during past operation. The apparent cause was a discrepancy between the maintenance and test equipment (M&TE) output and reference value seen by the bistable. The discrepancy can be attributed to a deficiency with the test points used to input the reference value.

T The failure mechanism was concluded to have been a faulty reference value that was sensed by the bistable. Surveillance procedures The OPDT bistable (3TC-441C/D) was replaced.T 3-PT-Q87 A through D where revised to require recording voltages that are inputted into the instrument loop.

Troubleshooting will be performed on the bistable circuit for possible test point deficiencies.

The event had no effect on public health and safety.

NRC FORM 366AU.S. NUCLEAR REGULATORY COMMISSION (9-2007) FACILITY NAME (1) DOCKET (2) LER NUMBER (6) PAGE (3)