Semantic search

On October 26, 2017, at 0212 hours with St. Lucie Unit 2 in Mode 1 at 100% power, the reactor automatically tripped due to a loss of load following a failure within the turbine control system. The reactor trip was uncomplicated and all control rod assemblies fully inserted. Following the trip, one of the low power feedwater valves LCV-9005, did not properly maintain steam generator level which resulted in an actuation of the A-train auxiliary feedwater system. During the auxiliary feedwater actuation, one main feedwater isolation valve did not reposition closed as expected, but this did not impact heat removal. The main feedwater system remained available.

The failure within the turbine control system was caused by design deficiencies. Planned corrective actions include modifications to improve protective circuits, the addition of coolers and use of conformal coatings on printed circuit boards in the modules.

The problem with LCV-9005 was due to a latent design error that resulted in the setting of an incorrect stroke length for the control valve. This was corrected by adjusting the stroke length of the valve.

This report is being reported in accordance with 10 CFR 50.73(a)(2)(iv)(A) for system actuations of the reactor protection system and the auxiliary feedwater system.

During this event offsite power remained operable and energized. All other equipment responded to the event as expected per the existing plant conditions; therefore, this event had no impact on the health and safety of the public.

Reported lessons learned are incorporated into the licensing process and fed back to industry.

Send comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

Description On October 26, 2017, at 0212 hours with St. Lucie Unit 2 in Mode 1 at 100% power, the reactor automatically tripped due to a loss of load following a failure within the non-safety related turbine control system (TCS) (EIIS:TG:DCC). Based on initial investigation, it was determined that a TCS malfunction affected multiple testable dump manifold (TDM) solenoids (EIIS:TG:PSV). Ultimately, electro-hydraulic (EH) (EIIS:TG) system pressure was lost (i.e., turbine tripped) after two TDM 1 solenoids spuriously operated concurrently. All high pressure turbine governor and throttle valves (EIIS:TA:XCV) and all low pressure turbine intercept and reheat stop valves (EIIS:TA:SHV) repositioned closed as expected upon loss of EH pressure. The reactor trip was uncomplicated and all control rod assemblies fully inserted.

Following the reactor trip, the 15% bypass feedwater regulating valve, LCV-9005 (EIIS:JB:LCV), did not provide the expected feedwater flow to the 2A Steam Generator (EIIS:JB:SG). This resulted in lowering steam generator level and an actuation of the A train auxiliary feedwater actuation system (AFAS) (EIIS:JC). During the auxiliary feedwater actuation, one main feedwater isolation valve (MFIV) (EIIS:JB:ISV), HCV-09-1A, did not reposition closed as expected, but this did not impact heat removal as the redundant MFIV in series isolated main feedwater. The main feedwater system remained available.

Cause of the Event

The failure within the turbine control system was caused by design deficiencies. The TCS incorporates various features for fault tolerance, including the use of three separate trip circuits for each TDM, the 2 out of 3 hydraulic logic of the TDM design, and redundant datalinks provided for Remote I/O communications. The design is intended to ensure a single failure or malfunction will not result in turbine trip. Replaced modules were retained for analysis. Two sets were sent to the original equipment manufacturer. The third set was sent to an independent lab for forensic analysis. Based on the results of the forensic analyses, this report may be supplemented with additional causal factors as appropriate.

The problem with LCV-9005 was due to a latent design error that resulted in the setting of an incorrect stroke length for the control valve. The stroke length of LCV-9005 has been properly adjusted.

The problem with HCV-09-1A was caused by a failed solenoid, and the solenoid was replaced.

Analysis of the Event

This licensee event report is being reported in accordance with 10 CFR 50.73(a)(2)(iv)(A) as “Any event or condition that resulted in manual or automatic actuation of any of the systems listed in paragraph (a)(2)(iv)(B).” This event included automatic actuations of the reactor protection system and the auxiliary feedwater system.

Testable Dump Manifolds The TCS has automatic control and trip devices necessary for operation and protection of the turbine-generator.

An automatic trip is provided to prevent any damage to the turbine-generator. The unit trips upon occurrence of conditions which are potentially hazardous to the turbine-generator or to other associated plant equipment. The TCS uses two headers to provide emergency turbine trip and overspeed protection. The emergency trip header has two testable dump manifolds (TDM 1 and TDM 2) and the overspeed protection header has one testable dump manifold (TDM 3). Each triple redundant electronic emergency trip system uses a TDM to interface with the control oil system. The 2-out-of-3 solenoid logic used to provide a protective trip also provides a means to test the system while on-line.

Reported lessons learned are incorporated into the licensing process and fed back to industry.

Send comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

Reviews of EH pressure data at each TDM showed that TDM 1 solenoid B was momentarily spuriously opening during the night prior to the event, and also that TDM 1 solenoid A and TDM 2 solenoid C had momentarily opened over the same time period. Approximately 30 minutes prior to the trip, TDM1 solenoid B opened and stayed open, putting TDM 1 into a continuous half trip state. The trip occurred after a second solenoid on TDM 1 spuriously opened.

Auxiliary Feedwater Actuation LCV-9005 and LCV-9006 are a pair of non-safety related 15% bypass feedwater regulating valves supplying main feedwater flow to the 2A and 2B SGs respectively with a predetermined set point and flow rate post trip. In 1997, LCV-9005 was replaced with what was intended to be a like for like valve replacement. However, the replacement LCV-9005 had different flow characteristics and a different stroke length that was not properly documented; therefore, not properly setup.

Prior to its replacement in 1997, LCV-9005 had a stroke length of 1.5 inches. The replacement valve had a stroke length of 2 inches. Stroke length is used to set up the control of the valve flow rate characteristics.

Therefore, the new model valve was only opening a percentage of a 1.5 inch stroke length instead of 2 inches.

This resulted in less flow than needed to automatically maintain flow to the steam generator without manual operation. A change in the plant conditions following implementation of a low power feedwater digital controller in 2013 compounded the effect of shortened valve stroke length that became apparent during this plant trip.

The opposite train valve LCV-9006 was determined to be operating with the proper stroke length, and main feedwater was used to feed the 2B Steam Generator post trip.

Safety Significance

The digital signals sent by the TCS to the TDMs during this event were reviewed and determined to be invalid and spurious. The turbine was not damaged or exposed to hazardous conditions during this event.

The auxiliary feedwater system is provided with complete sensor and control instrumentation to enable the system to automatically respond to a loss of steam generator inventory. Due to the incorrect setting of LCV- 9005 and the lowering water level in the 2A steam generator, the AFAS-1 actuation was valid. Once the mismatched 15% bypass feedwater regulating valve was isolated by AFAS-1, water level in the 2A steam generator was restored using auxiliary feedwater. 2B steam generator level was maintained post trip via LCV- 9006 and main feedwater.

During the auxiliary feedwater actuation, one of two MFIVs did not reposition closed as expected. There are two MFIVs in series on each feedwater train (A and B). The 2A train of main feedwater was automatically isolated by at least one MFIV. The Unit 2 UFSAR Table 7.3-12 describes failure modes and effects for the auxiliary feedwater actuation system. This analysis bounds the observation of the event described in this LER.

During this event offsite power remained operable and energized. Loss of turbine load events are bounded in the UFSAR as anticipated operational conditions. All other equipment responded to the event as expected per the existing plant conditions; therefore, this event had no impact on the health and safety of the public.

Corrective Actions

The corrective actions listed below are either completed or are being managed under the Corrective Action Program:

1. The three digital output modules controlling solenoids for TDM 1 were replaced, each consisting of an Electronics Module (EMOD), Personality Module (PMOD) and base assembly.

Reported lessons learned are incorporated into the licensing process and fed back to industry.

Send comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

2. The digital output module EMOD and PMOD for TDM 2 solenoid C was also replaced, as there was evidence that this solenoid had spuriously opened prior to the event.

3. The removed digital output modules were retained for analysis. Two sets (EMOD/PMOD/Base) from TDM 1 were sent to Emerson. The third set from TDM 1 was sent to an independent lab for forensic analysis.

4. Additional countermeasures measures were taken to further protect the TCS remote I/O cabinets from the environment. This included improving the remote TCS cabinets' environmental protection.

5. Actions are planned to install coolers for TCS cabinets.

6. Actions are planned to replace circuit card components in Remote I/O Cabinets.

7. Actions are planned to implement redundancy and diagnostics modifications to the TCS.

8. The stroke length of LCV-9005 was properly adjusted for a 2-inch stroke.

9. The failed solenoid on HCV-09-1A was replaced.

Failed Components Identified Turbine Control System Digital Output Module - Electronics Module (EMOD) Description: Digital Output 5-60VDC EMOD Manufacturer: Emerson Emerson Style Number: 1C31122G01 EMOD Serial Number: 3611019514 Emerson EMOD Module Revision 10 Turbine Control System Digital Output Module - Personality Module (PMOD) Description: Digital Output PMOD Manufacturer Emerson Emerson Style Number: 1C31125G02 PMOD Serial Number: T104316024 Emerson PMOD Module Revision 06 15% Bypass Feedwater Regulating Valve Manufacturer: Fisher Controls Co Inc. (Emerson) Valve Serial Number: 4” - 52A7148 Main Feedwater Isolation Valve Solenoid Description: valve:solenoid,3-way, 1/8" FNPT conn, carbon steel, 120 VDC,90 psi, normally closed Manufacturer: Parker Hannifin Part Number V5H71970 Cat ID322057-1

Additional Information

None

During a reactor startup performed on September 12, 2017, the operators noted that the inoperable ‘B' channel reactor protection system (RPS) high startup rate (HSUR) trip did not occur as expected when reactor power exceeded the HSUR bypass removal setpoint. The ‘B' RPS HSUR channel was then manually tripped via the bistable removal method and plant startup continued.

Investigation revealed that the setpoint reduction method process used to implement the RPS HSUR channel trip did not account for subsequent nuclear instrumentation (NI) detector failures. Therefore the ‘B' RPS HSUR channel was not in the required tripped condition since the February 2017 failure of its wide range NI detector.

The setpoint reduction method was subsequently revised to ensure inoperable RPS HSUR channels tripped by the setpoint reduction method generate a trip with reactor power less than 15 percent reactor power. A procedure revision is in progress to implement these new rule-based instructions.

This event had no significant impact on the health and safety of the public based on system channel redundancy and procedural controls.

Reported lessons learned are incorporated into the licensing process and fed back to industry.

Send comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

Description On September 12, 2017, St. Lucie Unit 1 was in a reactor startup in Mode 2 operation. The ‘B' channel reactor protection system (RPS) high startup rate (HSUR) (EIIS:JC) channel was thought to be in the reduced setpoint tripped condition in response to earlier unpredictable operation of the ‘B' channel nuclear instrumentation (NI) detector (EIIS:IG:DET). At 1522 hours during the startup, the operators noted that the ‘B' channel RPS HSUR bistable (EIIS:JC) did not automatically trip as expected for the existing plant conditions. The operators placed the ‘B' channel of RPS HSUR in a tripped condition in accordance with procedures by removing the bistable from the trip unit assembly and entered Technical Specification (TS) 3.3.1.1, Table 3.3-1, Functional Unit 11, Action 2 with the ‘B' channel HSUR bistable in trip. The reactor startup continued with the channel in trip as allowed by the Technical Specifications (TSs).

Cause of the Event

This event was caused by inadequate processes used to implement the HSUR reduced setpoint trip method. The instruction used did not evaluate all potential failure conditions when setting the HSUR bistable. Investigation showed that the bistable did not trip because the setpoint reduction method (initially) internally tripped the bistable in the presence of an active NI signal. When the ‘B' wide range NI detector subsequently failed low in February 2017, the input signal to the Hi Rate bistable from the rate circuit changed and the bistable trip conditions were no longer satisfied. During power operation this latent condition was partially masked by the greater than 15 percent power automatic bypass signal applied downstream of the comparator output circuitry. Additionally, the automatic bypass of the bistable trip signal below 10-4 percent power was never automatically removed during the startup due to the NI detector being failed low.

Following this investigation, maintenance and engineering personnel determined that the correct method to internally trip the bistable was to set the setpoint to the maximum negative value. This would ensure a trip would occur regardless of NI detector health whenever reactor power was less than 15 percent. The HSUR bypass for affected channels would also continue to be bypassed above 15 percent reactor power. A procedure revision is in progress to implement these new rule-based instructions.

Analysis of the Event

This event is reportable under 10 CR 50.73(a)(2)(i)(B) as any operation or condition that was prohibited by TSs.

The RPS HSUR trip is developed from the nuclear instrumentation (NI) wide range channels, and the trip signal may be automatically bypassed below 10 E-4 percent and above 15 percent power. When the trip is not bypassed, a reactor trip is initiated prior to the reactor power rate-of-change exceeding 2.49 decades per minute as measured by any two of the four wide-range NI channels.

Plant procedures provide two methods for placing an RPS HSUR channel in the trip condition. The first method pulls the Hi Rate bistable from the trip unit assembly. This method can be implemented quickly by control room operators, but has the disadvantage of sealing in a channel trip signal above 15 percent power. The second method has maintenance personnel reduce the bistable setpoint such that the channel would be expected to generate a trip signal with the automatic removal of the bypass between 10 E-4 percent and 15 percent power. This method has the advantage of preserving the automatic RPS HSUR bypass below 10 E-4 and greater than 15 percent power.

Prior to this event, the ‘B' channel wide range NI detector signal had been experiencing unpredictable operation, and the ‘B' RPS HSUR channel was placed in trip using the setpoint reduction method in October of 2016. During the Reported lessons learned are incorporated into the licensing process and fed back to industry.

Send comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

September 2017 plant startup, the ‘B' RPS HSUR channel did not trip as expected when reactor power exceeded the bypass removal setpoint of 10 E-4 percent power. The ‘B' wide range NI detector failed low on February 10, 2017.

The setpoint reduction method (used before the detector failed) was predicated on a baseline NI detector signal not a failed low detector signal; the setpoint reduction method did not account for the static failed detector voltage and its effect on the trip. Additionally, the failed low detector signal did not remove the bypass.

Safety Significance

The high rate-of-change of power trip is not credited in any of the Chapter 15 accident analyses. However, the trip is considered in the safety analysis, in that the presence of this trip function precluded the need for specific analyses of other events initiated from subcritical conditions (e.g., events not discussed in Chapter 15).

Subsequent to the ‘B' wide range detector failure on February 10, 2017, Unit 1 was within the HSUR bypass conditions with power greater than 15 percent. On September 11, 2017, Unit 1 was shutdown due to degrading switchyard environmental conditions caused by Hurricane Irma. The inadequately implemented reduced trip setpoint method had no effect during the evolution because the operating procedure used during this shutdown required that the reactor be tripped above 15 percent reactor power while the HSUR bypass was still in effect. In addition, the inoperative channel trip was detected in the subsequent September 12, 2017 startup and actions were taken as directed by the TSs; therefore the inoperative trip had no effect on the subsequent startup.

As previously stated, the HSUR bistable is required for operation during the reactor power ranges of 10 E-4 percent to 15 percent power. Per the design basis, the RPS has four independent measurement channels that monitor parameters and trip at TS prescribed setpoints. In addition, each RPS channel is required to be demonstrated operable by the performance of a successful monthly functional test. The RPS is designed to initiate a reactor trip when the two out of four coincidence logic is satisfied (i.e. high startup rate). Therefore, even with the ‘B' RPS HSUR channel in a nonconforming condition, there is reasonable assurance that the three remaining healthy HSUR channels would have performed the function of the RPS system to trip if TS prescribed setpoints were exceeded.

Based on the discussion above, this event had no significant impact on the health and safety of the public.

Corrective Actions

1. The ‘B' RPS HSUR channel was recalibrated, placed in trip using the new setpoint reduction method, and the bistable was re-inserted into the cabinet.

2. A procedure revision is in progress to implement the new rule-based setpoint reduction method.

Failed Components

Component: wide range nuclear instrumentation detector JI-002 Manufacturer: Sigma Model: 9222-00ED

Additional Information

None.

On May 15, 2017, at 1800 hours, the St. Lucie Unit 2 2A3 4.16 KV Bus undervoltage protection relays actuated resulting in a loss of power to the bus. The 2A emergency diesel generator (EDG) did not respond to this event as this EDG had been properly removed from service for pre-planned maintenance. The 2A3 4.16 KV Bus was restored to service at 2340 hours.

The 2A3 4.16 KV Bus was de-energized when an internal fault within the 2A EDG local voltmeter blew fuses that removed power from the undervoltage relays that resulted in the loads powered from this bus being stripped.

Corrective actions included replacing the fuses and replacing the susceptible local EDG voltmeter, as well as the interim use of caution tags on the susceptible voltmeter selection switches until modifications to remove the vulnerability are complete.

During this event the B train safety related electrical busses remained operable and energized. All other equipment responded to the event per the existing plant conditions and the unit remained at 100% power. The A train safety related electrical bus was restored to service well within the Technical Specification allowed outage time. Therefore, this event had no significant impact on the health and safety of the public.

Reported lessons learned are incorporated into the licensing process and fed back to industry.

Send comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

Description On May 15, 2017, St. Lucie Unit 2 was in Mode 1 at 100 percent reactor power. The 2A emergency diesel generator (EDG) (EIIS:DG) was removed from service due to planned maintenance. At 1800 hours, the 2A3 4.16 KV Bus undervoltage protection relays (EIIS:27) actuated resulting in a loss of power to the bus (EIIS:SWGR). However, the 2A EDG did not respond to this event as this EDG had been properly removed from service for pre-planned maintenance. The troubleshooting team identified blown potential transformer (PT) fuses (EIIS:FU) in the 2A EDG metering circuit. The failed fuses were replaced and the 2A3 4.16 KV Bus was repowered at 2340 hours. The required NRC ENS notification for the system actuation was completed by 0017 hours on May 16, 2017. During this event the B train safety related electrical busses remained operable and energized and the unit remained at 100% power.

Cause of the Event

The direct cause of the bus de-energization was determined to be failed secondary side PT fuses which provide power to the under voltage/degraded grid sensing circuity. The root cause was an internal failure within the local 2A EDG GE AB40 voltmeter (EIIS:MTR) causing a phase to phase short across the variable resistor. This condition resulted in the failure of the secondary PT fuses, resulting in the actuation of the 2A3 4.16 KV Bus UV relays. A contributing cause to this event was a latent design deficiency from original construction; the meter circuit did not have isolation fuses from the PT fuses. This allows an internal fault of the meter to open the protective circuit fuses and subsequently de-energize the UV relays.

Analysis of the Event

Even though the 2A EDG did not respond to the loss of the 2A3 bus because it was properly removed from service, the 2A3 4.16 KV bus UV protection relays did respond to the event and their actuation is reportable in accordance with 10 CFR 50.73(a)(2)(iv)(A).

Two conditions contributed to the plant response to the event:

1. The local voltmeter selector switch was in the 1-3 position. This position allowed the meter fault to be simultaneously communicated to both phases of the PT fuses. These fuses provide sensing power to the UV relays which provide electrical isolation to the safety related 2A3 4.16 KV bus. Upon sensing the loss of power to the onsite power system, the safety portion of the system is automatically isolated from the non- safety portion of the system by the operation of circuit breakers on the lines between non-safety and safety related buses.

2. The 2A EDG was out of service for the on-line preventive maintenance period. This precluded the 2A EDG from starting and assuming the loads of the 2A3 4.16 KV bus. Section 8.3 of the UFSAR, Table 8.3-6 4.16 KV Safety Related System – Failure Modes and Effects Analysis describes the consequences of loss of offsite and EDG power to the 2A3 or 2B3 bus. The analysis states that the loss of an EDG in this case will result in the loss of a one safety related bus, however, the redundant safety system remains to supply the redundant safety related loads. Additionally, DC control power in this event remained unaffected, and the A side instrument inverters remained powered throughout by the A side DC battery.

FPL performed extent of condition/extent of cause reviews for AC voltage metering circuits containing the GE AB40 voltmeter, as well as other voltmeters, for both units' safety related 4160 and 480 volt buses. The review determined that, with one exception, all remote voltage indication associated with the reactor turbine generator board (RTGB) voltmeters are all fused providing isolation of the metering circuit from their respective protective functions. The exception involves the Unit 2 local EDG voltmeters. The U2 EDG local metering circuits were determined to be the only safety related 4160 and 480 volt metering circuit whose failure could initiate a Reported lessons learned are incorporated into the licensing process and fed back to industry.

Send comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

protective function (e.g., blown PT fuses resulting in the de-energization of its associated bus UV relays). These reviews also identified several metering circuits that were not fuse protected; however, in these cases any proposed meter failure would only annunciate with no corresponding automatic protective function.

Safety Significance

The 2A EDG received a start signal from the under voltage condition on the 2A3 bus, but did not start as the EDG had been properly removed from service for preplanned maintenance. Upon a loss of indicated power to the potential transformers, the 2A3 4.16 KV bus responded appropriately for the existing plant conditions (e.g., the under voltage circuit relays actuated, the incoming breaker to the 4.16 KV bus opened, and a start signal was provided to the associated 2A EDG which was properly removed from service). Although the safety related 2A3 loads were lost during this event, the redundant loads serviced by the 2B3 train 4.16 KV safety related electrical bus remained unaffected by the event and the unit remained at 100% power.

Normal power was restored to the 2A3 4.16KV bus within 6 hours of the event, well within the allowable 8-hour Technical Specification action statement for restoring the 2A3 4.16 KV bus. Therefore, this event had no significant impact on the health and safety of the public.

The Unit 2 UFSAR section 8.3 describes Failure Modes and Effects for the 4.16 KV safety related system. This analysis bounds the observation of the event described in this LER.

Corrective Actions

EDG voltmeter selector switches directing that the switches not be left in the 1-3 position.

2. The local voltmeter for the 2A EDG was replaced.

The following corrective action is being managed under the Corrective Action Program:

3. The local voltmeter for the 2B EDG will be replaced.

4. FPL is developing a modification to the 2A and 2B EDG metering circuit to install coordinated fuses between the metering circuit and the PT fuses to isolate the metering circuit from the UV relays in the event of a voltmeter fault.

Failed Components Identified General Electric AB40 voltmeters

Additional Information

None

On March 1, 2017, Unit 2 was in a defueled condition during a refueling outage and transitioned to a single operable train of the control room emergency air cleanup system. While in this condition, movement of irradiated fuel is prohibited by Technical Specifications. Approximately 100 minutes after transitioning to the single operable train of the control room emergency air cleanup system, control room operators were informed that irradiated fuel inspections in the Fuel Handling Building were in progress.

Operators immediately placed the control room emergency air cleanup system on recirculation to comply with Technical Specifications.

The cause of this event was inadequate procedure instructions for the coordination of fuel handling activities in the spent fuel pool. Corrective actions included revising procedure instructions for the coordination of fuel handling activities.

This licensee event report is being reported in accordance with 10 CFR 50.73(a)(2)(i)(B) as a condition prohibited by Technical Specifications. This event had no impact on the environment or onsite personnel.

This event had no effect on the health and safety of the public.

On August 5, 2016, during Unit 1 restart following a maintenance outage, operators observed excessive seat leakage past a Reactor Coolant System (RCS) pressure isolation check valve. The flow path was promptly identified and isolated. A leak test was planned and performed at higher RCS pressure to quantify the leakage. The seat leak test at normal operating pressure was halted when an appropriate differential pressure was not achieved for testing. As a result, V3217, Safety Injection Loop 1A2 Check Valve, was declared inoperable, and Unit 1' was placed in Mode 5 COLD SHUTDOWN to complete repairs. The leakage past V3217 was caused by inadequate maintenance practices and procedures that did not ensure V3217 was within acceptable tolerances and correctly assembled in 2013.

Cofrective actions inclUde revisions to procedures for check valve maintenance, check valve trending and check valve preventive maintenance.

This event is reportable pursuant to.10 CFR 50.73(a)(2)(i)(B) as a condition prohibited by Technical Specifications. Since this condition was identified with Unit 1 in HOT STANDBY prior to reactor startup, the leaking check valve had no direct nuclear safety significance or impact to the environment.

This event had no effect on the health and safety of the public.

On October 19, 2015, during corrective maintenance activities on containment isolation valve FCV-26-3, maintenance personnel discovered that the valve actuator position limit switches were not wired correctly since December 2001.

This condition invalidated previous closure time surveillance results for this valve.

This condition is being reported pursuant to the requirements of 10 CFR 50.73(a)(2)(i)(B).

The wiring discrepancy was caused by a legacy maintenance human performance issue. The limit switch wiring was corrected, the post-maintenance testing was completed satisfactorily, and the valve was returned to service.

APPROVED BY OMB: NO. 3150-0104 EXPIRES: 01/31/2017 Reported lessons learned are incorporated into the licensing process and fed back to industry.

Send comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by intemet e-mail to Infocollects.Resourc,e@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

On August 9, 2015 with St. Lucie Unit 1 in Mode 1 at 100% reactor power, an unplanned reactor trip occurred. The trip occurred while Operators were performing a reactor protection system (RPS) logic matrix test in which the individuals performing the test did not follow the procedure steps in sequence resulting in a loss of configuration control. As a result, a set of reactor trip circuit breakers (TCBs) was opened before ensuring that all TCBs tested in the previous test section had been closed.

Corrective actions include procedure revisions to the test methodology to ensure configuration control of the TCBs is maintained through additional verification techniques.

This reactor trip event is reportable pursuant to 10 CFR 50.73(a)(2)(iv)(A) as an actuation of the reactor protection system (RPS). This event had no significant safety consequence since the RPS successfully performed its intended safety function upon opening the trip circuit breakers.

This event had no effect on the health and safety of the public.

On November 14, 2013 Unit 2 was in Mode 1 at 100 percent power when the 2B Steam Generator Train A main feedwater isolation valve (MFIV) HCV-09-2A spuriously stroked closed. This resulted in a manual reactor trip of Unit 2 due to rapidly lowering steam generator water level. The reactor trip was normal and uncomplicated. All safety related systems functioned as designed.

There were no automatic safety system actuations as a result of the trip. .

The MFIV closure was a result of corrosion of two relays (3Y/671 or 20X/671) located inside the relay box caused by internal water intrusion in the conduits.

Immediate corrective actions included replacing the degraded relays and installing internal conduit seals. An immediate extent of condition inspection and replacement resulted in installation of conduit seals and replacement of three degraded relays.

This event is reportable pursuant to 10 CFR 50.73(a)(2)(iv)(A) as a manual actuation of reactor protection system (RPS). All plant systems responded as designed and there was no safety significance associated with this event.

On June 3, 2013 at approximately 2000, Unit 2 was in Mode 1 at 8 percent power.

During monthly functional testing on the 2A hydrogen analyzer by Instrumentation and Controls ( I&C) personnel, the containment dome sample valve did not close when the selector switch was placed in the "OFF" position. The valve was not recognized as a containment isolation valve (CIV) and consequently the applicable technical .specification (TS) act ion statement to de- energize a downstream isolation valve within 4 hours was not entered. The downstream valve was however, in its normally closed position. Subsequently, the TS action statement was met by de- energizing the downstream valve.

This event is reportable pursuant to 10 CFR 5 0 . 7 3 (a) ( 2 ) ( i ) (B) as a condition prohibited by Technical Specifications. Since the sample valve is designated as a Class E piping penetration, and is designed to be open during a design basis event, this event had no significant safety impact. An apparent cause evaluation identified that the cause was a human error in evaluating the impact to plant operation caused by the failure of the hydrogen analyzer CIV.

Contributing causes included: 1) an inadequate procedure, and 2) ineffective hydrogen analyzer labeling.

Corrective actions include:

1) revision of the hydrogen analyzer procedure, 2) re- labeling the hydrogen analyzers to clearly demonstrate that the valves on the hydrogen analyzer are CIVs , and 3) operator briefing on lessons learned from the event.

On June 7, 2 0 1 2 , FPL determined that the April 2, 2 0 1 2 , failure of the St. Lucie 1A2 emergency diesel generator (EDG) immersion heater pressure boundary was reportable. The most likely failure mode would have rendered the EDG inoperable for longer than its allowed outage time. The failure was attributed to procedural inadequacies during the fill and vent of the EDG following maintenance performed during the SL1-24 refueling outage. A contributing factor included inadequate chemistry procedures.

Immediate corrective actions included replacement of the failed immersion heater, extent of condition electrical checks on all St. Lucie EDG immersion heaters.

Other corrective actions included EDG chemistry, maintenance, and startup procedure changes. Additionally, the immersion heaters will be replaced with a design not susceptible to the same failure mechanism.

This event did not have a significant impact on the health and safety of the public.

On October 19, 2011, St. Lucie Unit 1 was operating in Mode 1 at 86% when the unit was manually tripped due to rising condenser backpressure. The cause of the rising backpressure was an unplanned trip of the 1A1 circulating water (CW) pump.

Condenser backpressure reached procedural limits which required a manual unit trip. The 1A1 CW pump breaker tripped as a result of an internal motor fault.

Unit 1 was in a planned power reduction at the end of the cycle. All control element assemblies (CEAs) fully inserted and decay heat removal was achieved through main feedwater and steam bypass to the main condenser.

A root cause evaluation (RCE)concluded that ineffective condition monitoring of the 1A1 CW pump motor for degraded air flow passages prior to scheduled motor overhauls, resulted in a buildup of salt and corrosion products in the rotor cooling air flow passages, restricting air flow.

Contributing causes included previous actions to implement quarterly resistance temperature detector measurements for the CW pump motors were ineffective.

Corrective actions will implement temperature monitoring using the CW pump motor winding resistance temperature detectors (RTDs).

On August 22, 2011, St. Lucie Unit 1 was operating in Mode 1 at 89% when it was manually tripped due to rising condenser back pressure. All control element assemblies (CEAs) fully inserted into the core. The cause of the rising back circulating water system performance. Decay heat removal was initially from the main feedwater and steam bypass to the main condenser. However, subsequent to the manual trip, the 1B main feedwater pump was manually secured due to a leak on the pump casing. The 1A main feedwater pump subsequently tripped due to low suction pressure after manually securing the 1B condensate pump and decay heat removal was transitioned to the atmospheric dump valves and auxiliary feedwater.

Root cause evaluation determined the jellyfish intrusion rate exceeded the current capacity of the traveling water screens and trash pits. In addition, procedural guidance did not anticipate the possible rapidly escalating jellyfish intrusion rate and the urgency for response regarding the negative effect of the rapid jelly intrusion on condenser back pressure was not recognized.

Contributing causes included: plant maneuvering did not account for condenser back pressure margin, equipment degradation and malfunctions, and design deficiencies.

Corrective actions include procedure revisions and design changes to address procedure deficiencies and correct design deficiencies.