Semantic search

On December 23, 2010, with the reactor critical high in the Intermediate Range in the "Startup" mode, the reactor automatically scrammed on low main condenser vacuum. The cause was due to exceeding the 600 psig bypass reset enabling the low condenser vacuum trip prior to establishing the required vacuum. This bypass allows operation at reduced power below 600 psig during startup until adequate vacuum can be established in the main condenser.

The main condenser low vacuum reactor protection scram signal processed when reactor pressure was raised above the 600 psig bypass function during reactor startup. A procedure requirement for confirming all main condenser low vacuum alarms and trips are reset prior to exceeding 500 psig ensures that a scram signal is not present.

• The direct cause of the event was determined to be inadequate procedure compliance by the Unit Reactor Operator (URO) in not verifying that all requirements were met prior to proceeding above 500 psig reactor pressure. Corrective actions include enhancement of operating procedures to clearly define key milestones requiring supervisor concurrence prior to continuing with reactor startup or shutdown.

This event is being reported pursuant to: 10CFR50.73(a)(2)(iv)(A) due to an automatic actuation of the Reactor Protection System (RPS).

On September 19, 2014, -during refueling outage 01R26 with the unit in cold shutdown, a technician discovered that a previously authorized and installed Temporary Configuration Change (TCC) had been removed from a penetration in the Outboard Main

• Steam Isolation Valve Room (Trunnion Room). The purpose of the TCC is to Isolate the penetration from the Reactor Building (RB) to the Trunnion Room to allow the RB Trunnion Room door to be maintained open during refueling outages. Per Technical Specifications (TS) 3.5.8 and 4.5.G, in order to maintain secondary containment integrity with the Trunnion Room door open, four -1 penetrations connecting the Trunnion Room to the RB must be seated. The Trunnion Room door was open when the phi() was found removed from a 6" equipment drain hub. The plug was immediately reinstalled. On September 20, 2014, the Post Maintenance Testing (PMT) for the TCC reinstallation was executed in order to declare secondary containment operable. This PMT revealed that the Standby Gas Treatment System (SBGTS) could not achieve the required minimum differential pressure of - 0.26° water vacuum on the RB. The cause was determined to be an improperly latched personnel access hatch on'the Outer Reactor Building Airlock Door.

ENS 60476 was submitted on September 20, 2014. This issue is reportable under 10 CFR 60.73(a)(2)(v)(C) as an event that could have prevented the fulfillment of the safety function of a system needed to control the release of radioactive material, and 10 CFR 50.73(a)(2)(I)(8) as a condition which was prohibited by the OM'S Technical SpecificationS.

NRC FORM 368 (01.2014) ;I:MOVED SY Oita: NO. 31504104 . 01/348r Edrnated burden per wanes to comply sib this mandatory colactionmown IV hours..

Reported bosons lamed en hicapwaW into too Scans process and fed bock to Industry..

Send cement regardng burden nand, to tits FOIA, Pavony and Infonnadon Colections Branch (T6 FOS). US..N.0—m Regulatory Corrunbolon, Washington, DC 205550001, or by Intranet mat to Infacolocia.R

• soteclOnrc.gov, and to the Desk Ofrbor, Office of Inforrnedion and Rogutatay Miro, NE08-10202, (3160-0104), Oka of Mansoment and Budget, Wailintoon, DC 20503.If mews tread b impon an (*mato action dues not &play a

=only valid OW3 cartel number, 60410 bay not embed or spanner, end a person is not, rewired to respond b,tho Information collection.

'immirmiasimusumssolowaissemieser

CONTINUATION SHEET

1. FACIUTY NAME 3. DOCKET U.S. NUCLEAR REGULATORY COMMISSION

SENUMBER

QUENTIAL REV.; ♦ -iimmummisiW

Description of Event

On September 19, 2014, a technician discovered that a previously authorized and installed Temporary Configuration Change (TCC) had been removed from a penetration in the Outboard Main Steam Isolation Valve Room (trunnion room). The purpose of the TCC is to isolate penetration from the. Reactor Building (RB) to the Trunnion Room to allow the RB Trunnion Room door to be maintained open during refueling outages. Per Technical Specifications (TS) 3.6.9 and 4.5.G, In order to maintain secondary containment integrity with the Trunnion Room door open, four penetrations connecting the Trunnion Room to the RB must be sealed. The four penetrations consist of a 4" floor drain, a 6" equipment hub drain, a ventilation supply duct, and a ventilation return duct. The TCC of the four penetrations were installed on September 16, 2014, using a preventive maintenance work order to maintain secondary containment per TS noted above. There were no TCC tags on the individual components of the TCC. The work order directed the technician to attach a TCC tag on the Trunnion Room door once the TCC was installed. The TCC tag was affixed to the handle on the Trunnion Room door on September 18, 2014. when the TCC installation was verified by the Operations Department and taken active.

The Trunnion Room door was open when the plug was found to be removed from the 6* equipment drain hub on September 19, 2014, at 2359 hours. The plug was immediately reinstalled, restoring the safety function of the secondary containment. The Issue was not documented In the Corrective Action Program (CAP) until 0500 hours on September 20, 2014. At 0530 hours, on September 20, 2014, Standby Gas Treatment System (SBGTS-1) was placed in service with normal RB Ventilation secured to support VACP-1 and CIP-3 Transfer No issue was noted at that time. At 0630 hours, Secondary containment was declared inoperable due to the Trunnion Room .TCC removal, until Post Modification Testing (PMT) could be performed. At 0808 hours,' SBGTS-1 was placed in service for PMT M accordance with Procedure 330, "Standby Gas Treatment System," and normal RB Ventilation was secured In accordance with Procedure 329, "Reactor Building Heating, Cooling and Ventilation System." At 0812 hours, RB differential pressure was noted to be requirements of Procedure 329 and TS 4.5.G.3. At 0959 hours, the RB Inner railroad airlock door Is closed and RB differential pressure returns to the required range (I.e., > - 0.26" water vacuum). At 1000 hours, secondary containment is declared operable.

It could not be determined who removed the equipment hub drain plug associated with the TCC. There is no direct monitoring device, such as a card reader, that can be used to identify an individual accessing the Trunnion Room. The maximum time of non-compliance was 26 hours, based on the last successful Trunnion Room TCC verification on September 18.2014.

Secondary containment was declared operable at 1000 hours on September 20, 20t4, after closing the inner railroad airlock door . At 1108 hours, on September 20;2014, the outer RB railroad airlock door Is found locked closed, but not property latched with the hand wheel not in the expected closed position. The key log for that controls the issuance of the keys for the railroad airlocks revealed that the key was last signed out on September 18;2014. It is not clear when on the September 18, 2014, the door was last used and closed.

NEI 99-02 (Revision 7), Regulatory Assessment Performance Indicator Guidelines, Section 2.2, Mitigating Systems Cornerstone, Safety System Functional Failures, Clarifying NOVA states the following:

Engineering analyses: events in which the licensee declared a system inoperable but an engineering analysis later determined that the system was capable of performing its safety function are not counted, even if the system was removed from service to perform the analysis.

This event will not be reported in the NRC Performance Indicator (PI) for Safety System Functional Failures (SSFF) since an engineering analysis (technical evaluation) was performed which determined that the secondary containment system was capable of performing its safety function dudng this event. .

Analysis of Event

There was no actual safety consequence associated with this event and the potential safety consequences of this event were minimal.

QIN

FORM 388A 01.2014) Per TS Bases, secondary containment is designed to minimize any ground level release of radioactive materials which might result from a serious accident. The RB provides secondary containment during reactor operation when the dryweil is sealed and in service and provides primary containment when the reactor is shutdown and the drywall is open, as during refueling. The Trunnion Room door may remain open during shutdown conditions (cold shutdown condition and refuel mode) when the Trunnion Room has been isolated from the secondary containment through the RB walls, penetrations and either the inboard or outboard valves to the main steam and feedwater piping being secured in the closed position. RB differential pressure was maintained negative at all times when secondary containment was lost at - 0.20" water vacuum. This is both above the alarm set point of 0.14 +/- 4" H2O and ensures a secure secondary containment boundary since a Loss of Coolant Accident (LOCA) or high energy pipe break accident is not credible during cold shutdown conditions.

An Apparent Cause Evaluation (ACE) was performed to determine the failed barriers that resulted in part of the Trunnion Room TCC being removed during 01R25.

A technical evaluation was conducted to demonstrate that during the period that the seal on the equipment hub drain was not in place, the safety function of secondary containment was still in place. The evaluation determined that even with the additional opening of the 8" equipment hub drain, secondary containment requirements were met with significant margin. The calculation bounds the condition of the unsealed hub drain in the Trunnion Room; therefore, the safety function of secondary containment was not compromised by this condition.

Cause of Event

• The Apparent Cause of this event was inadequate signage on the Trunnion Room door and drain covers. The only TCC tag was on the outside of the Trunnion room door and with the door opened, the TCC tag was not clearly visible.

• Contributing to this event was the individual removing the drain cover to utilize the drain without understanding the basis for the drain being covered, or ensuring proper controls were in-place to remove the cover.

• Contributing to this event was a lack of a questioning attitude by the individual(s) who removed the drain cover,

• The cause of the improperly latched airlock door could not be identified.

Immediate Actions:

• The TCC was reinstalled.

• Additional TCC tags were affixed to each piece that comprised the TCC, and a tag was affixed to the inside and outside of the Trunnion Room door.

• Signage was affixed to each piece of the TCC stating not to remove TCC without Shift Manager approval.

Corrective Actions

• Perform a review of this event with Maintenance, Operations, and Radiation Protection departments. Specific emphasis on manipulating plant equipment without proper controlling documentation and/or Shift Manager permission.

• Revise the library copy of the applicable preventive maintenance work order to be specific to label each component with TCC tag and signage to prevent removal without Shift Manager approval. Verify that the procedure requirements of CC- AA-112, "Temporary Configuration Changes," are met.

• Procedure 312.3 was revised to require an independent Verification when closing the Reactor Building Airlock Doors.

Previous Occurrences

None.

Component Data Coniponents IEEE 805 System ID IEEE 803A Function Reactor Building NO DRN 1

On April 21, 2003, Nine Mile Point Unit 1 (NMP1), having recently ended a refueling outage, was at low power preparing for technical specification (TS) required testing of six solenoid-actuated pressure relief valves (also referred to as Electromatic Relief Valves or ERVs). At 2117 with power approximately 23 percent, solenoid-actuated pressure relief valve, ERV-111, failed to open during testing. TS 3.1.5.a requires that all six ERVs be operable whenever the reactor coolant pressure is greater than 110 psig. At 2117 the action statement of TS 3.1.5.b was entered. After the remaining five ERVs were satisfactorily tested, NMP1 began a shutdown at 2230. The reactor was subcritical at 0055 on April 22, 2003. NMP1 exited the action statement at 0250. During the cooldown, the TS cooldown limit of 100 degrees Fahrenheit (F) in one hour was marginally exceeded (101 degrees F In one hour) for approximately three minutes In two of four loops. An engineering evaluation of the cooldown concluded that Appendix G requirements were not violated and that the structural Integrity of the reactor pressure vessel was not compromised.

The ERV-111 failure was due to high resistance in Its associated solenoid cut-out switch contacts. An inadequate preventive maintenance (PM) procedure did not specify measuring the contact resistance, hence the contact resistance increased unnoticed until the failure. Exceeding the cooldown limit occurred because the shutdown procedure did not adequately identify steam loads that should be secured to prevent exceeding the cooldown limit when decay heat values are low.

Corrective actions for the ERV failure include replacing the solenoid valve for ERV-111, modifying the PM procedure, and testing the resistance of the cut-out switch contacts on the remaining five ERVs. The corrective actions to address exceeding the cooldown rate are modifying the shutdown procedure and providing training on the event.

The test failure of ERV-111 Is reportable in accordance with 10 CFR 50.73(a)(2)(i)(a), in that the failure resulted In a TS required shutdown. Exceeding the TS cooldown limit of 100 degrees F In one hour is reportable in accordance with 10 CFR 50.73(aX2)(1)(13) as operation prohibited by the technical specifications.

At 1056 on November 10, 2010, Nine Mile Point Unit 1 scrammed from full power operation due to closure of outboard Main Steam Isolation Valves (MSIVs) 01-03 and 01-04. Valves 01-03 and 01-04 closed following receipt of an invalid low-low reactor water level signal.

The scram was the result of a combination of two latent preexisting plant conditions and performance of a quarterly instrument channel surveillance test. The first preexisting condition was misaligned connector pins on Grayboot splice connectors for outboard MSIV Channel 11 solenoid operated valves. The cause of the misalignment was determined to be insufficient rigor in the behaviors and knowledge (training) used in identifying appropriate post maintenance testing (PMT) requirements. The second preexisting condition was a misaligned contact spring in isolation logic Channel 12 relay 12K74 (General Electric (GE) Model CR305).

The cause of this failure was excess material (plastic) left during fabrication of the relay's movable contact holder.

Immediate actions were to repair the Channel 11 Grayboot splice connectors and replace Channel 12 relay 12K74. Training will be provided to planning personnel to ensure an adequate understanding of complex/redundant circuits for the proper determination of PMT requirements. Procedure/manuals governing Grayboot connector maintenance activities will be revised to include additional post assembly inspections and testing.

On October 19, 2003, at 1658 hours (CDT), with Unit 2 shutdown for Refueling Outage 02R18, it was discovered that the combined leak rate for all Main Steam Isolation Valve leakage paths exceeded the Technical Specification Surveillance Requirement 3.6.1.3.10 allowed value of 46 standard cubic feet per hour.

The root cause of the Main Steam isolation Valve leak rate was determined to be a loss of line contact at the valve seat/disk interface. The valves were repaired and the as-left leakage was within Technical Specification limits. The corrective actions to prevent reoccurrence are: (1) inspect ail Main Steam Isolation Valves and if required, repair with the single point cutting tool method within two operating cycles, and (2) the Main Steam Isolation Valve repair procedure will be updated to require machining valve seats instead of lapping.

The safety significance of this event was minimal. The total as-found primary containment leakage including Main Steam Isolation Valve leakage was 209.7 scfh and is below the total allowable leakage of 432.3 scfh assumed in accident analyses. Thus, the total as-found primary containment leakage would have resulted in exposures during a postulated Design Basis Accident that did not exceed 10 CFR 100 limits for offsite dose or General Design Criteria 19 limits for control room dose.

On March 24, 2005, at 0529 hours (CST), with Unit 2 at approximately 96 percent power, two unexpected control room alarms were received for exceeding the Electro-Hydraulic Control System maximum combined flow limit setpoint and open Turbine Bypass Valves. Several seconds later, high flow in the Main Steam System resulted in a signal to close the Main Steam Isolation Valves that initiated an automatic reactor scram. All control rods fully inserted and all other systems responded to the reactor scram as expected, except for non-safety related equipment, the Turbine Generator Lube Oil Pump and the 2B Reactor Feedwater Pump Auxiliary Oil Pump, which did not operate as required.

The root cause of this event is indeterminate. The most probable cause is attributed to an increase in electrical resistance between electrical pins 13 and 22 on the "A54" card within the Electro-Hydraulic Control System. The corrective actions to prevent recurrence are to replace the "A54" card backplane connector, remake all termipoints on the connector for the "A54" card and to rework the remaining connectors between electrical pins 13 and 22. The "A54" card backplane connector was replaced and the all termipoints on the refueling outage.

On February 16, 2005, at approximately 2112 EST, with the plant in Mode 1 at approximately 100% steady state reactor power, the reactor automatically tripped. The Control Room operators performed the appropriate actions of procedures E-0 and ES-0.1. Following the reactor trip, all safety systems operated as designed, with the exception of the control function for the main steam atmospheric relief valves (ARVs). The reactor was stabilized in Mode 3.

The tripping of the reactor was caused by a turbine trip as the result of an anticipated-transient without-scram (ATWS) mitigation actuation circuitry (AMSAC) signal. The AMSAC signal was the result of low feedwater flow signals, caused by the failure of redundant advanced digital feedwater control system (ADFCS) power supplies. The ARV automatic and remote manual operation was also affected by the failed power supplies.

. .0 .

Corrective action to prevent recurrence is outlined in Section V.B.

On January 27, 2007, at approximately 2040 EST, with the plant in Mode 1, initially at 100% steady state reactor power, an event occurred resulting in an automatic reactor trip. The Control Room operators performed the appropriate actions of procedures E-0 and ES-0.1. Following the reactor trip, all safety systems operated as designed. The reactor was stabilized in Mode 3.

The reactor trip was the result of a loss of electrical load transient, which is attributed to a failure in the Main Turbine Electro Hydraulic Control (EHC) system that caused the four high pressure turbine control valves to rapidly close simultaneously. The loss of electrical generation resulted in a heat-up of the reactor coolant system and an actuation of the Reactor Protection System (RPS) on Over-Temperature Differential Temperature.

Corrective action to prevent recurrence is outlined in Section V.B.

0 NRC FORM NZ (84004) PRINTED ON RECYCLED PAPER

2006, at 1035 hours, operators initiated a manual reactor trip (RT) due to a mismatch between reactor power and turbine load.T On August 23, control room (CR)T Power was initially reduced to 77% for loss of Heater Drain Tank (HDT) pumps then further reduced per Technical Specification 3.2.3 due to axial flux difference outside its required operating limit. CR operators initiated a RT during the further power reduction due to a mismatch between reactor power and turbine load from cyclic operation of the high pressure steam dump (HPSD) valves.T The All primary safety systems functioned properly.

plant was stabilized in hot standby with decay heat being removed by the main condenser.

There was no radiation release. The Emergency Diesel Generators did not start as offsite power remained in-service. The Auxiliary Feedwater system (AFWS) started due to steam generator (SG)T Feedwater (FW)Tlow level from shrink effect.Tisolation and actuation of the AFWS occurred due to a 22 SG high level as a result of overfeed from leakby through the 22 FW low flow bypass valve. The cause of the RT was improper gain settings on the HPSD temperature modules which caused the HPSD's to respond increasingly disproportional to the input signal.T The improper settings were attributed to inadequate review during implementation of actions for the Power Uprate Project in 2004.

The cause of the loss of the HDT pumps was a failed HDT level controller power supply.

Contributing causes included incorrect information in the HPSD module calibration procedure and inadequate procedural guidance.T Corrective actions include properly setting the HPSD modules, replacement of the HDT power supply, preparation of a calibration procedure for the HPSD modules, calibration training and procedure revisions.T The event had no effect on public health and safety.

On April 3, 2009, Control Room Operators initiated a manual reactor trip as a result of observing decreasing steam generator (SG) levels following loss of the 21 Main Boiler Feedwater Pump (MBFP), a large steam flow to feedwater flow mismatch, and failure of the main turbine to automatically runback.T All control rods fully inserted and all required safety systems functioned properly. The plant was stabilized in hot standby with decay heat being removed by the main condenser which was subsequently shifted to the atmospheric dump valves.T The direct cause of the decreasing SG levels was the trip of MBFP 21 due to a autostop oil tubing/fitting failure on the MBFP Autostop oil header.

T The root cause was improper tubing installation due to poor worker practices.

A straight tubing installation with no bends to allow for expansion and contraction or to allow for motion under load resulted in vibration induced stress failure.

T The cause of the turbine runback failure was indeterminate but most likely an intermittent failure of the digital speed tachometer assembly.

T Corrective actions included replacement of the tubing for both MBFPs reconfigured to meet established installation requirements, performance of an independent equipment failure evaluation of the failed fitting, and implementation of a troubleshooting plan on the runback feature to confirm functionality.T Five year maintenance requalification training for Swagelok fitting installation will be established and supplemental worker training for Swagelok fitting installation will be developed.T The event had no effect on public health and safety.

On January 11, 2010, an automatic reactor trip (RT) was initiated as a result of turbine trip due to a loss of main generator excitation. The plant was stabilized in hot standby with decay heat being removed by the main condenser (SG). The Auxiliary Feedwater System automatically started as expected due to SG low level from shrink effect.TPrior to the RT one of four rectifiers (#24) of the main generator excitation system was believed to be electrically isolated and its cooling was isolated to stop an existing cooling leak.

Investigations determined the rectifier disconnect switch that was believed to be open remained in a closed condition.T This condition allowed current to continue to flow through the 24 rectifier diodes and because there was no cooling water the diodes failed resulting in a loss of field voltage to the exciter actuating a trip signal.TThe direct cause of the RT was loss of generator field excitation due to loss of two diodes within the # 24 Generrex rectifier cabinet.T The root cause was failure of management to implement critical decision making. A significant contributing cause was an improper lubricant used on disconnect switch contact surfaces.T Corrective actions included a brief of station personnel on the event and lessons learned.TA Generrex upgrade modification will be implemented including new disconnect switches in the spring 2010 refueling outage, case study training will be completed, computer based training (CBT) from the case study will be prepared and included in training curriculum, Alarm Response Procedure (2-ARP-SJF) and System Operating Procedure (2-SOP-24.4) will be revised for operation of the new disconnect switches, and maintenance personnel will be instructed on appropriate application of greases.T The event had no effect on public health and safety.

On November 7, 2010, an automatic reactor trip (RT) was initiated as a result of a turbine-generator trip due to actuation of the main generator primary and back-up lockout relays. All control rods fully inserted and all primary systems functioned per design except for the 138 kV Station Auxiliary Transformer tap changer. The plant was stabilized in hot standby with decay heat being removed by the main condenser (SG). Based on reports of two explosions an Alert was declared in accordance with the emergency plan which was terminated at 22:18 hours. There was no radiation release. The Emergency Diesel Generators did not start as offsite power remained available. The Auxiliary Feedwater System automatically started as expected due to SG low level from shrink effect. The direct cause of the RT was due to actuation of the 86P and 86BU relays that sensed a fault from the failure of 21 main transformer (MT) as a result of a low impedance fault of the 345 kV Phase B bushing. The root cause was an internal failure of the phase B bushing due to a vendor design/manufacturing deficiency.

Corrective actions include replacement and acceptance testing of the 21 MT, external visual inspections of the 22 MT HV bushings, Unit Auxiliary Transformer (UAT), Iso-phase bus and 345 kV feeder W95, testing of the 22 MT, UAT, Iso-phase bus and HV components. Damaged HV components were replaced. The bushings for the 21 and 22 MT were replaced with another manufacturers bushing. The event had no effect on public health and safety.

On June 6, 2012, an automatic reactor trip (RT) was initiated as a result of a main Turbine-Generator trip due to a trip of the Generator backup lockout relay 86 BU on loss of main generator field excitation.

All control rods fully inserted and all required safety systems functioned properly. The plant was stabilized in hot standby with decay heat being removed by the main condenser. The Auxiliary Feedwater System automatically started as expected due to SG low level from shrink effect.

Investigations determined the 86 BU relay actuation was triggered by relay 62BU1/AUX which serves as a time delay for the KLF-40 loss of field relay.

TThe actuation of the loss of field relay was in response to a loss of generator excitation field from the Generrex voltage regulator system.

T The direct cause of the RT was loss of generator field excitation due to failure of the Generrex C-Phase Trigger Generation Card.T The root cause was indeterminate but most likely due to premature failure of the U5 operational amplifier on the C-Phase Trigger Generation Card causing the U3 and U6 operational amplifiers to also degrade. Corrective actions included replacement of the C-Phase Trigger Generator and AC/DC Gate cards with new cards which were then calibrated and monitored for proper operation, and shipped failed card to a vendor for an equipment failure analysis.T The event had no effect on public health and safety.

On July 3,'2013, operators initiated a manual reactor trip as a result of lowering steam generator (SG) levels due to the loss of feedwater (FW) from the trip of both main FW pumps. All control rods fully inserted and all required safety systems functioned properly. The plant was stabilized in hot standby with decay heat being removed by the main condenser. The Auxiliary Feedwater System automatically started as expected. Investigations determined the decreasing SG levels were due to a loss of main FW flow as a result of the closure of the FW regulating valves. The FW regulating valves closed due to a loss of instrument air (IA) pressure. The IA pressure was lost when a two inch copper IA tubing in the 22 Main Transformer moat separated at a soldered coupling. Prior to the event piping lines including the IA line buried in the main transformer moat were excavated and temporary supports installed. The apparent cause was poor legacy workmanship assembling the IA tubing coupling during original plant construction. The IA tubing was not fully inserted into the coupling resulting in reduced joint strength. Corrective actions included reassembly and soldering of the IA joint with full insertion, acoustic emission and snoop testing on repaired coupling.

Axial and thrust restraints were installed on the IA line in the moat. A caution was placed in the Buried Piping Program database associated with buried copper tubing identifying the potential for the separation of soldered joints when the line is excavated and the need for restraints or other contingencies to minimize the probability of a line separation.

The event had no effect on public health and safety.

On March 4, 2016, during the performance of surveillance procedure 2-PT-R006, Main Steam Safety Valve (MSSV) MS-45B failed to lift within the Technical Specification (TS) as- ' found required range of +/- 3% of the setpoint pressure. Valve MS-45B lifted at 1125 psig, 29 psig outside its acceptance range of 1034 to 1096 psig and 5.7% above its 1065 psig setpoint. The valve was declared inoperable, then subsequently restored to operability upon two successful lifts within the required setpoint range without the need for adjustment. Nine other MSSVs that were tested lifted within the as-found required setpoint range. The apparent cause for the failure was internal friction due to spindle rod wear, which causes the spindle rod to bind against internal components.

Corrective actions were modification of MS-45B and twelve other MSSVs, and the replacement of their spindle rods. The event had no effect on public health and safety.

On July 6, 2016,Instrument and Control (I&C) technicians were preparing to perform 2-PT-2M3A (RPS Logic Train B Actuation Logic Test and Tadot). Prior to starting the test, the I&C technicians were unable to locate key #184 that was identified in the test as associated with the reactor trip breaker B bypass key switch. Control Room staff recommended obtaining key #183 associated with reactor trip breaker A bypass key switch to use in lieu of key #184. To ensure the key would work prior to starting the test, the train B bypass key switch was positioned by an I&C technician to the Defeat position. Because reactor trip Bypass Breaker B was in the racked out position, when the key switch was taken to the Defeat position, it caused the normal Reactor Trip Breaker B to open, which initiated a reactor trip (RT) and auxiliary feedwater system actuation. The direct cause was an I&C technician turned the key interlock to defeat on switchgear Channel B Reactor Protection Logic without having the BYB Bypass breaker racked in and closed. The root cause was Indian Point personnel emphasized work culture production goals without fully recognizing the need to maintain fundamental standards and expectations for nuclear workers. Key corrective actions included site all-hands meeting discussing the event, lessons learned, reinforced expectations and the Fleet Refocus Initiative. As an interim action, all essential work that effects generation was required to have direct oversight by a superintendent or above, all work start authorizations provided by operations undergo a work challenge utilizing a new checklist from this event. Complete the actions associated with the Fleet Refocus Observation program. The event had no effect on public health and safety.

Indian Point 2 05000-2'47 APPROVED BY OMB: NO. 3150-0104 EXPIRES: 10/31/2018 comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by Internet e-mail to Note: The Energy Industry Identification System Codes are identified within the brackets (1.

DESCRIPTION OF EVENT

On July 6, 2016,while at 100 percent reactor power, preparations were in progress to commence a scheduled bi-monthly surveillance test in accordance with 2-PT-2M3A (RPS Logic Train B Actuation Logic Test and TADOT (>25% Reactor Power)). The purpose of the surveillance is to perform actuation logic testing of the Reactor Protection System (JC) logic Train B in accordance with Technical Specification (TS) 3.3.1 (Reactor Protection System Instrumentation) Table 3.3.1-1, Function 20, Surveillance Requirement 3.3.1.5. The test had been originally scheduled for June 30, 2016, but due to concerns about Battery Changer 22 grounds, the test was re-scheduled for the following week., At approximately 07:30 hours, on July 6, 2016, a pre-job briefing was held with four I&C technicians and the I&C job Supervisor. Subsequent to the briefing, the I&C technicians went to the Control Room (NA) and informed the Control Room Supervisor (CRS) of the test and what to expect. In the prerequisites section of 2-PT-2M3A, the breaker interlock key number 182, 184 or equivalent was to be obtained from operations prior to commencing the test. At approximately 9:15 hours, I&C personnel determined neither key number 182 nor key number 184 could be found in the Control Room key locker. The CRS suggested that the Train A key number 183 could be used as an equivalent because it was believed that both trains were keyed the same.

Due to concerns with the short Technical Specification (TS) 8-hour Allowed Outage Time (AOT) for the test the I&C technicians wanted to ensure the key would work prior to entering the TS Limiting Condition for Operation (LCO) and starting the test and discussed it with the CRS. The key concerns were discussed with the CRS. After a brief discussion, the I&C technicians believed that Operations gave them permission to test the key prior to starting the surveillance test. Operations believed that the I&C technicians would test the key during the surveillance.

At approximately 9:30 hours, two of the I&C technicians, one operator and two Nuclear Plant Operator (NPOs) took key number 183 (designated for Train A) to the location of the Reactor Trip Breakers (RTBs) (BKR)(Cable Spreading Room) (NA). The 8-hour TS LCO was not entered. Two non-licensed operators (NPOs) were present in the Cable Spreading Room to rack in the bypass breaker when requested by the I&C technicians.

The Field Shift Supervisor (FSS) was also there to inspect cables that were utilized with the Rod Drop Testing during the recent outage. One of the I&C technicians called the Control Room and told another I&C technician, who was staged in the Control Room, that they would receive an annunciator on Panel SK, Window 2-5. The Control Room operator acknowledged the alert of an expected alarm and the I&C technician in the Control Room relayed the acknowledgement to the I&C technician in the Cable Spreading Room containing the RTBs.

comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by intemet e-mail to An I&C technician signaled the other I&C technician that was at the RTBs to test the key. Without using a procedure or an approved work instruction, the other I&C technician positioned the Train B bypass key switch to defeat.. Because reactor trip Bypass Breaker B was in the racked out position, when the train B bypass key switch was taken to the Defeat position, it caused the normal Reactor Trip Breaker B to open, which initiated a reactor trip (RT) at approximately 9:38 hours.

All control rods (AA) fully inserted and all required safety systems functioned properly. The plant was stabilized in hot standby with decay heat being removed by the condenser (SG). The auxiliary feedwater system (BA) actuated as expected due to steam generator low level from shrink effect.

Normally during performance of the test, the train B bypass key switch is only positioned to Defeat after Bypass Breaker B has been closed and the Reactor Trip Breaker B- has been opened. The condition was recorded in the Indian Point Energy Center (IPEC) Corrective Action Program (CAP) in. Condition Report CR-IP2-2016-04320.

The reactor protection system (RPS) (JC) initiates a reactor shutdown, based on values of selected unit parameters, to protect against violating the core fuel design limits and reactor coolant system pressure boundary during anticipated operational occurrences and to assist the Engineered Safety Feature Systems in mitigating accidents. The RPS instrumentation is segmented into four distinct but interconnected modules one of which is reactor trip switchgear that includes the reactor trip breakers (RTBs) and Bypass Breakers. These components provide a means to interrupt power to the control rod drive mechanisms (CRDMs) and allows the rod cluster control assemblies (RCCAs) or rods to fall into the core and shut down the reactor. The bypass breakers allow testing of the RTBs at power. The control rod drive system is designed such that the control rods are held in place and are capable of being moved only when its power supply is energized. Two RTBs placed in series with the control rod drive power supply remain closed as long as their respective under-voltage coils are kept energized by the RPS logic buses. Two bypass breakers are provided to allow in service testing of either RTB. The key-interlock switch is provided such that if both bypass breakers are closed at the same time while racked in, both bypass breakers will be tripped. This interlock is defeated in the test position with the key to allow for tripping of the undervoltage device of the bypass breaker when the reactor is in operation. The key interlock switch at the Reactor Trip Switchgear is placed in the Defeat position to prevent repeated breaker operation as the logics are tripped and reset.

During normal testing of the RPS Logic, the bypass breaker is racked in and closed and the key-interlock switch would then only bring in the alarm in the Control Room supervisory annunciator. For this event the bypass breaker was not racked in (closed).

comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by Internet e-mail to The bypass breakers must be manually closed and under no circumstances should both bypass breakers be racked in and closed at the same time. During normal testing of Channel B, the associated key-interlock switch would have been placed in the defeat position. This would have resulted in: 1) Illuminating a red light on the Train B cabinet, 2) Annunciating an alarm RTB & BYA Train B Defeat on the Control Room supervisory annunciator, 3) Opened up the closing circuit of RTB which is being tested, 4) Opened up the coil circuit of undervoltage trip devices for breakers RTB and BYA which is being tested and preventing the unit from tripping. In this event the key bypass switch was turned to the defeat position while the Bypass Breaker was still racked out (open) which de-energized the undervoltage coil for the B RTB which caused it to open and trip the unit.

An extent of condition (EOC) review determined the condition is bounded to only the RTBs because they are the only breakers with a key-interlocked switch such that if both bypass breakers are closed at the same time while racked in, both bypass breakers will be tripped. The test procedure for unit 2 calls for key number 182, 184 or allows for an equivalent key to be used. This is vague guidance unlike unit 3 which only has one key. The Unit 2 test procedure 2-PT-2M3A will be revised to remove "equivalent.

CAUSE OF EVENT

The direct cause of the RT was due to operating the "B" RPS bypass key out of sequence during Reactor Protection logic testing. An I&C technician turned the key interlock to defeat on switchgear Channel B Reactor Protection Logic without having the BYB Bypass Breaker racked in and closed, which opened the undervoltage tripping device of the RTB and tripped the reactor. The I&C technician turned the key without procedural guidance. The I&C technicians were testing the key with verbal guidance from operations, due to vague procedure guidance in 2-PT-2M3A, that allowed an equivalent key to be used (number 183). Due to not stopping when unsure (conservative decision making), the I&C technicians tested the key prior to starting the surveillance because of perceived time pressure.

The root cause (RC) of the event was that IPEC personnel emphasized work culture production goals for productivity, schedule adherence, and backlog reduction without fully recognizing the need to maintain fundamental standards and expectations for nuclear workers, such as procedure use and adherence and staying in process during work activities. The RC resulted in the I&C technician turning the key without procedure guidance or work instructions and tripped the plant.

CORRECTIVE ACTIONS

The following corrective actions have been or Action Program (CAP) to address the causes of

• Site all-hands meeting was held to discuss to reinforce expectations.

will be performed under the Corrective this event:

the event, the lessons learned, and comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by intemet e-mail to

• discuss the Fleet Refocus Initiative.

• work that effects generation was to have direct oversight by a superintendent or above.

• All work start authorizations provided by operations watch personnel must now undergo an additional work challenge utilizing a checklist developed in response to this event. Revised process was formalized by an Operations Standing Order.

• The completion of corrective actions associated with the Fleet Refocus Observation Program will be documented to ensure all personnel apply the essential knowledge, skills, behaviors and practices needed to conduct work safely and reliably.

• Procedures 2-PT-2M3, 2-PT-2M2, and 2-PT-2M2A will be revised to remove the word "equivalent" to prevent any questions on which key to use.

EVENT ANALYSIS

The event is reportable under 10CFR50.73(a)(2)(iv)(A). The licensee shall report any event or condition that resulted in manual or automatic actuation of any of the systems listed under 10CFR50.73(a)(2)(iv)(B). Systems to which the requirements of 10CFR50.73(a)(2)(iv)(A) apply for this event include the Reactor Protection System including reactor trip and AFWS actuation. This event meets the reporting criteria because an automatic reactor trip was initiated at 9:38 hours, on July 6, 2016, and the AFWS actuated as a result of the RT. On July 6, 2016, at 13:16 hours, a four hour non-emergency notification was made to the NRC (Log Number 52067) for an automatic reactor trip while critical and included the eight hour non-emergency notification for the actuation of the AFW system. Both notifications were in accordance with 10CFR50.72(b)(3)(iv)(1). The event was recorded in the Indian Point Energy Center corrective action program (CAP) as CR-IP2-2016-04320.

As all primary safety systems functioned properly there was no safety system functional failure reportable under 10CFR50.73(a)(2)(v).

PAST SIMILAR EVENTS

A review was performed of the past three years of Licensee Event Reports (LERs) for events that involved a reactor trip due to testing of the reactor protection system.

No applicable LERs were identified.

SAFETY SIGNIFICANCE

This event had no effect on the health and safety of the public.

This condition had no effect on the health and safety of the public.

There were no actual safety consequences for the event because the event was an uncomplicated reactor trip with no other transients or accidents.

• Small Group Meetings.

• from the Fleet Refocus Initiative.

Site All-hands meeting was held to Conducted Fleet Refocus Initiative Implemented observation activities As an interim action all essential comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by intemet e-mail to Required primary safety systems performed as designed when the RT was initiated. The AFWS actuation was an expected reaction as a result of low SG water level due to SG void fraction (shrink), which occurs after a RT and main steam back pressure as a result of the rapid reduction of steam flow due to turbine control valve closure.

For this RT there was no actual condition to initiate the reactor trip breaker opening. Event was initiated by human error.

There were no significant potential safety consequences of this event. The RPS is designed to actuate .a RT for any anticipated combination of plant conditions to include low SG level. All components in the RCS were designed to withstand the effects of cyclic loads due to reactor system temperature and pressure changes. The reactor trip breakers (RTBs) are in the electrical power supply line from the control rod drive motor generator set power supply to the CRDMs. Opening of the RTBs interrupts power to the CRDMs, which allows the shutdown rods to fall into the core by gravity. Each reactor trip breaker (RTB) is equipped with a reactor trip bypass breaker (RTBB) to allow testing of the trip breaker while the unit is at power. Each RTB and RTBB is equipped with an undervoltage coil and a shunt trip coil to trip the breaker open when needed. The reactor trip signals generated by the RPS automatic trip logic cause the RTBs and associated RTBB to open and shut down the reactor.

There are two RTBs in series so that opening either will interrupt power to the rod control system and allow the control rods to fall into the core and shut down the reactor. Each RTB has a parallel RTBB that is normally open. This feature allows testing of the RTBs at power. A trip signal from RPS logic train A will trip RTB A and RTBB B; and a trip signal from logic train B will trip RTB B and RTBB A. During normal operation, both RTBs are closed and both RTBBs are open. When any one train is taken out of service for testing, the other train is capable of providing unit monitoring and protection until the testing has been completed.

For this event, rod control was in automatic and all rods inserted upon initiation of a RT. The AFWS actuated and provided required FW flow to-the SGs. RCS pressure remained below the set point for pressurizer PORV or code safety valve operation and above the set point for automatic safety injection actuation. Following the RT, the plant was stabilized in hot standby.

Indian Point 2 05000-247

On January 30, 2004, at 1155 hours (CST), with Unit 3 at 97 percent power in Mode 1, an automatic scram occurred due to a Main Turbine trip from low lube oil pressure. The event occurred during a swapping of lube oil coolers. After the scram, reactor water level increased above the Reactor Feed Pump High Level trip set point. Reactor water level was subsequently restored to normal and the Reactor Feed Pumps were restarted.

On February 1, 2004, at 0400 hours (CST), subsequent investigations into the. January 30, 2004, event determined that the High Pressure Coolant Injection Systems for Dresden Units 2 and 3 were inoperable. The inoperability was due to evaluations that determined that the Feedwater Level Control System would not maintain the post scram reactor water level below that which would prevent water from entering the High Pressure Coolant Injection System's turbine steam line.

The root cause of the automatic scram was inadequate procedural guidance for the swapping of Main Turbine lube oil coolers. The root cause of the High Pressure Coolant Injection System inoperability was low margin in the Feedwater Level Control System to accommodate changes to the post-scram vessel level response. The corrective action to prevent reoccurrence of the scram is to modify procedure DOP 5100-04, "Turbine Oil Cooler Operation? The corrective action to prevent reoccurrence of the High Pressure Coolant Injection Systems inoperability is to modify the post-scram response of the Feedwater Level Control System.

On November 6, 2014, with the reactor in mode 5, an electromatic relief valve (ERV) actuator failed to open during the performance of scheduled surveillance testing. The surveillance involves an operator manually actuating the ERV from the main control room with operators staged in the field. The operators in the field reported an audible click when the manual actuation was initiated. However, when the demand signal was given, the actuator plunger did not move and the valve did not open. The Apparent Cause of failure was determined to be that actuator design is susceptible to vibration induced wear in conjunction with the vibration particularly on the 13' Main Steam Line near the 3E ERV.

Corrective actions include replacement of ERV actuators with a hardened design, future inspections of supporting structures, and identifying the source of elevated vibrations.

This failure has been determined to be of very low safety significance.

This event is being reported under 10 CFR 50.73(a)(2)(i)(B) "Any operation or condition which was prohibited by the plant's Technical Specifications," and under 10 CFR 50.73(a)(2)(v)(D), "Any event or condition that could have prevented the fulfilment of the safety function of structures or systems that are needed to mitigate the consequence of an accident.

On February 27, 2003, Turkey Point Unit 3 was in Mode 1 and holding at approximately 60 percent reactor power while performing Technical Specification surveillance testing of the Main Steam Safety Valves setpoints. T Three Main Steam Safety Valves lifted outside the Technical Specification limits of +/- 3% due to micro-bonding between the valve and the disc. T In each case, the unit entered then exited the applicable Technical Specification 3.7.1.1.b Action Statement as the valves were removed from service, then returned to service within the Technical Specification allowed outage time of 4 hours.

A fourth Main Steam Safety Valve lifted outside the Technical Specification Limit due to a misalignment of the valve yoke rod and nut and could not be returned to service.

The plant entered the Action Statement for Technical Specification 3.7.1.1.b and reactor power was reduced below 53 percent.

During the planned unit refueling shutdown which commenced on March 1, 2003, all four valves were disassembled, repaired, and returned to service prior to unit restart.

Operation of the facility with the Main Steam Safety Valves as-found settings was within analytical bounds; therefore, this event had no impact on the health and safety of the public.

On March 5, 2006, Turkey Point Unit 3 was in Mode 1 and holding at approximately 50 percent reactor power while performing Technical Specification surveillance testing of the Main Steam Safety Valves setpoints, just prior to the Unit 3 Cycle 22 Refueling Outage. The Unit 3 C Steam Generator (SG) MSSV, RV-3-1412, as-found lift pressure was 1154.6 psig, which was greater than the TS allowable setpoint pressure of t 3% of 1115 psig (1081.6 psig - 1148.4 psig). RV-3 1412 was declared inoperable and the plant entered TS action statement 3.7.1.1.b. Reactor power was at 50%, which was below the 53% reactor power required per TS 3.7.1.1.b. The valve was subsequently adjusted and retested twice to within ± 1% of its required setpoint. In addition, the Unit 3 B SG MSSV, RV-3-1406, as-found lift pressure was 1154 psig, outside the TS allowable setpoint of t 3% of 1100 psig (1067 psig - 1133 psig).

The cause of the failure to meet TS allowable setpoint for RV-3-1412 was a slow build-up of corrosion between the disc 1 holder/guide interface and/or the spring/spring washers. The cause of the failure to meet TS allowable setpoint for RV-3 1406 was micro-bonding. During the planned Unit 3 refueling shutdown which commenced on March 5, 2006, the valves were either replaced with a spare or, the original valve was disassembled and repaired.

Operation of the facility with the Main Steam Safety Valves as-found settings was within analytical bounds; therefore, this event had no impact on the health and safety of the public.

On 8/25/12, at approximately 1140, Turkey Point Unit 3 was in Mode 2. The Operations Department was performing the Main Turbine Valve Alignment, in preparation for turbine start-up following a refueling outage. During the alignment verification, Operations discovered the root isolation valves for the Turbine inlet pressure transmitters closed when they were required to be open. The Main Steam pressure transmitters, PT-3-446 and PT-3-447, provide input to various protection and control functions. Upon discovery of this condition, operators entered Technical Specification (TS) 3.0.3 for Unit 3 because the Minimum Channels Operable requirements of TS 3.3.2, Table 3.3-2, Functional Unit 1.f (Safety Injection, Steam Line flow - High coincident with SG pressure Low or Low Tavg) and TS 3.3.2, Table 3.3-2, Functional Unit 4.d (Steam Line Isolation) were not met. The isolation valves were then opened and TS 3.0.3 was exited at approximately 1239.

The cause was determined to be lack of rigor in ensuring a proper follow-up review of a modification, which added the new root isolation valves at the High Pressure Turbine inlet pressure tap locations.