ML17229A173

LER 96-005-00:on 961206,determined That Independent Operability of Trip Coils Had Not Been Adequately Tested. Caused by Inadequate Surveillance Procedure.Performed Testing of Coils & Revised procedures.W/961220 Ltr

ML17229A173
Person / Time
Site:	Saint Lucie
Issue date:	12/20/1996
From:	BENKEN E J, STALL J A FLORIDA POWER & LIGHT CO.
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
L-96-337, LER-96-005-02, LER-96-5-2, NUDOCS 9612260012
Download: ML17229A173 (9)

Text

~CATEGORY1REGULATORYINFORMATIONDISTRIBUTIONSYSTEM(RIDS)ACCESSXONNBR:9612260012DOC.DATE:96/12/20NOTARIZED:NOFACIL:50-389St.LuciePlant,Unit2,FloridaPower&LightCo.AUTH.NAMEAUTHORAFFILIATIONBENKEN,E.J.FloridaPower&LightCo.STALL,J.A,FloridaPower&LightCo.RECIP.NAMERECIPIENTAFFILIATIONDOCKET05000389

SUBJECT:

LER96-005-00:on961206,determinedthatindependentoperabilityoftripcoilshadnotbeenadequatelytested.Causedbyinadequatesurveillanceprocedure.Performedtestingofcoils&revisedprocedures.W/961220ltr.DZSTRZBUTZONCODE:ZE22TCOFZESRECEZVED:LTR2ENCL/SZZE:TXTXE:50.73/50.9LicenseeEventReport(XER),IncidentRpt,etc.NOTES:RECIPIENTIDCODE/NAMEPD2-3PDINTERNAL:ACRSAEOD/SPD/RRABNRR/DE/ECGBNRR/DE/EMEBNRR/DRCH/HICBNRR/DRCH/HQMBNRR/DSSA/SPLBRES/DET/EIBEXTERNAL:LSTLOBBYWARDNOACMURPHY,G.ANRCPDRCOPIESLTTRENCL111122111111111111111111RECIPIENTIDCODE/NAMEWIENS,L.BFILECENELBNRR/DRCH/HHFBNRR/DRCH/HOLBNRR/DRPM/PECBNRR/DSSA/SRXBRGN2FXLE01LXTCOBRYCE,JHNOACPOORE,W.NUDOCSFULLTXTCOPIESLTTRENCL11221111111111111'111111DENOTETOALL"RIDS"RECIPIENTS:PLEASEHELPUSTOREDUCEWASTE!CONTACTTHEDOCUMENTCONTROLDESK,ROOMOWFNSD-5(EXT.415-2083)TOELIMINATEYOURNAMEFROMDISTRIBUTIONLISTSFORDOCUMENTSYOUDON'TNEED!FULLTEXTCONVERSIONREQUIREDTOTALNUMBEROFCOPIESREQUIRED:LTTR26ENCL26 FloridaPower&LightCompany,P.O.Box128,FortPierce,FL34954.0128December20,1996L-96-33710CFR50.73U.S.NuclearRegulatoryCommissionAttn:DocumentControlDeskWashington,D.C.20555Re:St.LucieUnit2DocketNo.50-389ReportableEvent:96-005DateofEvent:December6,1996OperationProhibitedbyTechnicalSpecifications'breakersTheattachedLicenseeEventReportisbeingsubmittedpursuanttotherequirementsof10CFR50.73toprovidenotificationofthesubjectevent.Verytrulyyours,J.A.StallVicePresidentSt.LuciePlantJAS/EJBAttachmentcc;RegionalAdministrator,USNRCRegionIISeniorResidentInspector,USNRC,St.LuciePlant96i22600i296i220PDRADQCK050003898PDRanFPLGroupcompanyM(t NRCFORM388(4.96)U.S.NUCLEARREGULATORYCOMMISSIONLICENSEEEVENTREPORT(LER)(Seereverseforrequirednumberofdigits/charactersforeachblock)APPROVEDSYOMSNO.3160<104sxFSIEs04isorseESTIMATEDBURDENPERRESPONSEToCOMPLYWITHTHISMANDATOINFORMATIONCOLLECTIONREQUESTI60.0HRS.REPORTEDLESSONLEARNEDAREINCORPORATEDINTOTHEUCENSINOPROCESSANDFBACKTONOUSTRY.FORWARDCOMMENTSREGARDINGBURDENESTIMATTOTHEINFORMATIONANORECORDSMANAGEMENTBRANCHmeF33IUWNUCLEARREGIAATORYCOMMISSION.WASHINGTON.OC20666~1ANDTOTHEPAPERWORKREDUCTIONPROJECT(31600104),OFHCE0MANAGEMENTANDBUDGET,WASHINGTON,OC20603.FACILITYNAMEIllSTLUCIEUNIT2DOCKETNISASBl(2105000389PAGEnl1OF7TITLE14lOperationProhibitedbyTechnicalSpecificationsduetoInadequateSurveillanceTestingofReactorTripBreakers12OAY0696SEQUENTIALREVISIONNUMBERNUMBER96-005-00MONTHDAY122096FACIUTYNAMEN/AFACIUlYNAM6N/ADOCKETNUMSERDOCKETNUMBEROPERATIN0MODE(9)POWERLEVEL(10)<MC4':;<;:x"'.>320.2201(b)20.2203(a)(2)(i)20.2203(a){2){iii)20.2203(0)(2)(iv)20.2203(0){2)(v)20.2203(a)(3)(ii)50.38(c)(1)50.38(c)(2)50.73{a){2){i)60.73(a)(2)(ai)50.73(a){2)(v)50.73(a)(2)(vii)50.73(a)(2){viii)73.71OTHERSpecifyinAbstractbeloworInNRCForm3BBANAMEEdwinJ.Benken,LicensingEngineerTELEPHONENUMBEROnc4aahraacoda)(561)467-7156cAUBESYSTEMCOMPONENTMANUFACTURERREPORTABLEToNPRDSCAUSESYSTEMCOMPONENTREPORTABLEToNPROSYEB{Ifyee,completeEXPECTEDSUBMISSIONDATE).XNoEXPECTEDSUBMISSIONDATE(16)MONTHOAYYEARABSTRACT(umitto1400spaces,i.eapproximately15single.spacedtypewrittenlines)(18)OnDecember6,1996,St.LucieUnit2wasoperatinginMode1at100percentreactorpower.WhileperformingareviewasrequestedbyNRCGenericLetter96-01,"TestingofSafetyRelatedLogicCircuits,"FPLdeterminedthattheindependentoperabilityoftripcoilsassociatedwiththeReactorProtectiveSystem(RPS)TripCircuitBreakers(TCB)hadnotbeenadequatelytestedbysurveillanceprocedure.TheappropriateTechnicalSpecificationActionrequirementswereimplementedforfailuretoperformasurveillancerequirement.AdditionaltestingwasinitiatedandsubsequentlycompletedsatisfactorilyperTechnicalSpecificationrequirements.Thecauseoftheeventwasaninadequatesurveillanceprocedurefortestingtheoperationofthereactortripcircuitbreakers.Correctiveactionsinclude:1)OperabilitytestingofthetripcoilswasperformedtoincludeadditionaltestingofelectricalcontactsintheTCBcircuitpaths.2)ThesurveillanceproceduregoverningthetestingoftheReactorProtectiveSystemlogicwaschangedtoincludetestingtherequiredcircuitrycontacts.3)AdditionalsafetyrelatedelectricalcircuitryiscontinuingtobereviewedwithregardtotestingadequacyinaccordancewiththeactionsrequestedinNRCGenericLetter96-01.

NRCFORM366AI4-9SILICENSEEEVENTREPORT(LER)TEXTCONTINUATIONU.S.NUCLEARREGULATORYCOMMISSIST.LUCIEUNIT205000389YEARSEQUENTIALREVISION96-005-002OF7TEXTilfmorespeceisrequired,useedditionelcopiesoffVRCf'orm366AiI17IOnDecember6,1996,withSt.LucieUnit2operatinginMode1at100percentpower,FPLengineeringpersonneldeterminedthattheindependentoperabilityoftheundervoltageandshunttripelectricallogicpathsfortheReactorTripCircuitBreakers(TCBs)(EIIS:JC)maynothavebeenadequatelytestedbycurrentSt.LucieUnit2procedures.ThisdeterminationwasmadefollowingareviewofasimilarconditionfoundatPaloVerdeStationandanassessmentofNRCGenericLetter,96-01,"TestingofSafetyRelatedLogicCircuits"forapplicabilitytoSt.LuciePlant.St.LucieUnit2TechnicalSpecification(TS)4.3.1.1,requiresthatafunctionaltestbeperformedatleastonceper18monthsorfollowingmaintenanceoradjustmentofthereactortripcircuitbreakerstoverifytheindependentoperabilityoftheundervoltageandshunttrips.At1705onDecember6,1996,basedupontheabovedetermination,OperationsinvokedTechnicalS,cification4.0.3.forfailuretoperformasurveillancerequirementwithintheallowedsurveillanceinterval.AConditionReport(CR)wasinitiatedtoassessthevalidityofthetestingrequirementsandreviewtheoperabilityoftheTCBs.TS4.0.3specifiesthatfailuretoperformasurveillancerequirementwithintheallowedsurveillanceintervalshallconstitutenoncompliancewiththeoperabilityrequirementsforaLimitingConditionforOperation(LCO)~TS4.0.3allowsthatactionrequirementsmaybedelayedforupto24hourstopermitthecompletionofasurveillancewhentheallowableoutagetimelimitsoftheLCOactionrequirementsarelessthan24hours.Followingdiscoveryoftheabovecondition,functionaltestingwasinitiatedat2145,onDecember6,1996,toverifytheindependentoperabilityoftheundervoltageandshunttripsforthereactorTCBs.Thistestingwascompletedsatisfactorilyat2215onDecember6,1996,andTS4.0.3wasthenexited.Thecauseoftheeventwasaninadequatesurveillancetestprocedure.OperatingProcedure2-1400059,"ReactorProtectionSystem-PeriodicLogicMatrixTest,"containstheinstructionsforperformanceoftheoperabilitytestfortheReactorTripCircuitBreakersshunttripandundervoltagetripdevices(coils).Thesurveillancetestinstructionsoftheprocedureverifiedthesatisfactoryoperationofbothoftheaboveshuntandundervoltagetripdevices,andwereconsistentwithvendorrecommendations,however,thetestdidnotverifytheindependentoperationoftheelectricalcontactswhichoperatetheshuntandundervoltagetripcoils.Atthetimeoftheevent,thesurveillanceadequacyofthereactortripcircuitbreakershadbeenidentifiedforadditionalengineeringreviewinaccordancewiththeschedulereferencedintheFPLresponsetoGenericLetter96-01,datedApril18,1996.Thiseventisreportableunder10CFR50.73(a)(2)(i)(B)as"anyoperationorconditionprohibitedbytheplant'sTechnicalSpecifications."St.LucieUnit2TS4.3.1.1requiresthateachreactorprotectiveinstrumentationchannelbedemonstratedoperablebytheperformanceofthechannelcheck,channelcalibrationandchannelfunctionaltestoperationsfortheModesandfrequenciesshownintable4.3-".NRCFORM388AI49SI NRCFORM368AI4-96ILICENSEEEVENTREPORT(LER)TEXTCONTINUATIONU.S.NUCLEARREGULATORYCOMMISSIST.LUCIEUNIT205000389YEARSEQUENTIALREVISION96-005-003OF7TEXT/ifmorespecsisrequired,useedditionelcopiesofNRCcform366A/I17ITStable4.3.1requiresthatatleastonceper18monthsandfollowingmaintenanceandadjustmentofthereactortripbreakers,thechannelfunctionaltestshallincludeverificationoftheindependentoperabilityoftheundervoltageandshunttrips.Followinga,determinationthattheindependentoperabilityoftheaboveundervoltageandshunttripdeviceshadnotbeenadequatelytestedatSt.LuciaUnit2,OperationspersonnelimplementedthesurveillancerequirementsofTS4.0.3.Aspreviouslydiscussed,TS4.0.3specifiesthatfailuretoperformasurveillancerequirementwithintheallowedsurveillanceintervalconstitutesnoncompliancewiththeoperabilityrequirementsfo'ranLCOandpermitsactionrequirementstobedelayedforupto24hourstofacilitatecompletionofthesurveillance.FPLsatisfactorilyperformedtheadditional,requiredtestingoftheelectricallogicpathsa<<ociatedwiththereactortripcircuitbreakerswithintheallowabletimeconstraintsofTS4.0.3.ThereactortripcircuitbreakersareafunctionalunitoftheReactorProtectiveSystem(RPS)instrumentationatSt.LuciePlant.TheoperabilityoftheRPSinstrumentationandbypassesensuresthat1)theassociatedreactortripwillbeinitiatedwhenamonitoredparameterreachesitssetpoint,2)thespecifiedcoincidencelogicismaintained,3)sufficientredundancyismaintainedtopermitachanneltobeoutofservicefortestingormaintenance,and4)sufficientsystemfunctionalcapabilityisavailablefromdiverseparameters.TheRPSisdesignedsothatanysinglefailurewithinthesystemwillnotpreventproperprotectiveactionatthesystemlevelwhenrequired.TherearefourReactorTripChannelsassociatedwiththeRPS.Atwo-out-of-fourRPSlogictripsignalresultsinthedeenergizationoffourtrippathrelays,whichinturnresultsinthedeenergizationofundervoltagecoilsandenergizationofshunttripcoilsoneightreactorTCBs(RefertoFigure1).EitherofthetwotripcoilsassociatedwithareactorTCBiscapableoftrippingthebreakerfromanRPSactuation.BothofthetrippathsareactuatedbythesameRPSrelayandusedifferentsetsofrelaycontactstoactuatetheirassociatedtripcoils(RefertoFigure2).Oneor>>bothofthesecontactschangingstatewillresultintheopeningoftheTCB.ThefollowingtestsareperformedatSt.LucietoverifytheoperabilityofthereactorTCBs:TheTripCoilofeachreactorTCBistestedbyuseofatestpush-buttonwhichenergizestheshunttripcoilandopensthebreaker.Thistestisconductedatleastevery18monthsandfollowingmaintenanceoradjustmentoftheTCB.2.TheUndervoltage(UV)CoilofeachreactorTCBistestedbyremovingthepowersupplyfusewhichdeenergizestheUVcoilandopensthebreaker.Thistestisalsoconductedevery18monthsandfollowingmaintenanceoradjustmentoftheTCB.3.TheRPSPeriodicLogicMatrixTestisperformedeachmonthtoverifythatRPStrippathrelaysfunctioncorrectlyandtheTCBsopenwhenrequired.NRCFORM368AI4-96I NRCFORM368AI4-9SILICENSEEEVENTREPORT(LER)TEXTCONTINUATIONU.S.NUCLEARREGUlATORYCOMINISSIOST.LUCIEUNIT2YEARSEQUENTIALREVISION0500038996-005-004OF7TEXT(Ifmorespecsisrequired,useedditionelcopiesofNRC&rm368AJI17)Asdescribedbytheabovetests,theabilityofthereactortripbreakerstoopenonanRPSactuationsignalisdemonstratedbytheRPSLogicMatrixTest,whichisperformedmonthly.Additionally,theoperabilityoftheTCBtripcoilsandundervoltagecoilsisdemonstratedatleastevery18months.Performanceoftheabovetesting,however,doesnotspecificallyverifythatthecontactsintheelectricallogicpathschangestatetoactuatetheundervoltageorshunttripcoils.IndividualcontactsthatperformasafetyfunctionarerequiredtobetestedinaccordancewiththeguidanceprovidedbyGenericLetter96-01.Subsequenttothisevent,FPLEngineeringperformedareviewofthetestingrequirementsassociatedwiththereactorTCBs.ThisreviewdeterminedthatwhilethepotentialforanundetectedfailureofonecontactintheelectricalflowpathtoanRPSTCBexistsduringperformanceoftheRPSLogicMatrixTest,thiswillnotresultinthefailureoftheTCBtotrip.Thedualpath,electricalarrangementassociatedwitheachreactorTCBisnotdesignedasaredundantfeature,asthereisnoseparationorisolation,andcommonequipmentisusedinbothpaths.Thetwopathsarediverse,however,inthatdifferentmechanisms(energizationvs.deenergizationandtheuseofdifferenttripcoils)areprovidedfoincreasedreliabilityofthetripmechanism.AreviewofTCBsurveillancetestsperformedatSt.LucieUnit1determinedthatatUnit1,theRPSLogicMatrixTestProcedure,performedmonthly,includesaverificationofindicatinglights(uniquetoUnit1)providedinboththeshuntandundervoltagetrippaths.TheseindicatinglightsarenotavailableatSt.LucieUnit2.Additionally,St.LucieUnit1TechnicalSpecificationsdonotrequireafunctionalcheckbeperformedoftheindependentoperabilityoftheshuntandundervoltagetrippaths.Therefore,thisconditionisnotapplicabletoSt.LucieUnit1.AdditionalsurveillancetestingperformedasaresultofthiseventsatisfactorilydemonstratedthattheelectricallogiccontactsresponsibleforactuatingtheundervoltageandshunttripcoilsonthereactorTCBswereoperational.Noreactortrippathsweredisabledasaresultofthesubjecttestinginadequacy,andsufficientsystemdiversityandfunctionalcapabilitywasmaintained.Basedupontheabove,theprotectionofthe'healthandsafetyofthepublicwasnotadverselyaffectedbytheevent.TestingoftheelectricallogiccontactsforthereactortripcircuitbreakerswassatisfactorilyperformedonDecember6,1996.2.TheSt.LucieUnit2ReactorProtectionSystem-PeriodicLogicMatrixTestProcedure(2-1400059)wasrevisedtoincludeadditionalverificationofTripRelayContactoperationduringthe18monthsurveillanceperformance.NRCFORM388AI4.96I NRCFORM366A4.95ILICENSEEEVENTREPORT(LER)TEXTCONTINUATIONU.S.NUCLEARREGULATORYCOMMISSIOST.LUCIEUNIT205000389YEARSEQUENTIALREVISION96-005-005OF7TEXT(Ifmorespaceisrequired,useadditionalcopiesofNRCForm368AJI17I3.InaccordancewithGenericLetter96-01,FPLiscontinuingtoreviewapplicablesafetyrelatelogiccircuitryandtestingprocedurestoensurethatallcircuitcomponentsrequiredtobetestedareadequatelyaddressedbysurveillanceprocedures.NoneNoneNRCFORM386AH-9S)

NRCFORM388A14-96)LICENSEEEVENTREPORT(LER)TEXTCONTINUATIONU.S.NUCLEARREGULATORYCOMMISSIST.LUCIEUNIT205000389YEARSEQUENTIALREVISION96-005-006OF7TEXTfifmorespaceisreqvired,useadditionalcopiesoflIl'RCForm866AlI17IREACTORPROTECTIYESYSTEMSIMPLIFIEDLOGICDIAGRAMI238$7891091238$8789109I234$8789109I238$8789109INPUTSFROMIBSSMEAsUREMENTaIANNELSCHANNELATRIPUNITSCHANNEL8CHANNELCCHANNELDLCGIcA.BLOGICANLOGICA0LOGICMATRICESIA87ASlA8lIACIACIiAO2LOGICMATIYKRELAYS8-CLOGICB.DLOGICC.DLOGIC8818Ct8CI8CiKl1187I1871SD4CO>807807COIMA120VACINSTRUMENTBVSMB120YACINSTRUMENTBVSMC120VACINSTRUMENTBUSMD120VACINSTRUMENTBUSTRIPPA1113AB1AC1AD1BCI801C01AB2AC2AD2BC2BD2C024'ACA80VACBVS'IBVS2MAINCIRCVITBREAKERSMOTORGENERATORS~240VACA83AC3A03BC3803C03A84AC4A04BC4BD4C04TRIPCIRCIATBREAKERCONTROLRELAYS12$YDCl(USB((KAIMANUALTT8PI4~IIMANUAL778P27IKI12$/USAKIUVSTSTTTYPaRCUITBREAKERSUY12$YDCI(USAKA12$YDCBVSB+STST~aamwangaITY9DENOTESADDITeNALREACTORTRIPUNITONDIAT2CCWLOSSOFFLOW81DMDUALCEDMPOWERSUPPLIESCEDMCONTROLSYSTEMUeIYIDVALCEDMPOWERSUPPUESGEOMPOWERSUPPUESPIRCOD111807.CEDMCEDMCEDMCOILSCOILSGOESCEDMCEDMCEDMCONTROLELEMENTCaLSCalsGalsDRIVEMECHANISMSNRCFORM388A14.96)

NRCFORM388ALICENSEEEVENTREPORT(LER)TEXTCONTINUATIONU.S.NUCLEARREGULATORYCOMMISSIST.LUCIEUNIT205000389YEARSEQUENTIALREVISION96-005-00'7OF7TEXT(ifmorespeceisreqirired,IrseeddidoneicopiesofNRCFarm3M4lI17)REACTORTRIPCIRCUITBREAKERSIMPLIFIEDWIRINGDIAGRAIYI(TYPICAL)NORMALLYCLOSEDINOTTESTEOIIIOEPENOENTLY)NORMALLYOPENINOTTESTEOINOEPENOENTI.Y)TESTPUSHBUTTONBKS12m)I?EMERGTRIPPUSHBUTTONMANUALTRIPPUSHBUTTON(RTGB)-REEDPSCLOSESONTESTUNDERVOLTAGEUVDCOILREEHEBRZSH?SPENTKBSHUNTTRIPCOILBKBQlZEBTC