05000336/LER-1997-008-02, :on 970310,repts Review Facility Compliance W/ GL 96-01 for Reactor Protective Sys Received.Caused by Inadequate Program to Ensure Surveillance Procedures Fully Implement TS Requirements.Procedures Revised

:on 970310,repts Review Facility Compliance W/ GL 96-01 for Reactor Protective Sys Received.Caused by Inadequate Program to Ensure Surveillance Procedures Fully Implement TS Requirements.Procedures Revised

ML20137T699
Person / Time
Site:	Millstone
Issue date:	04/08/1997
From:	Joshi R NORTHEAST NUCLEAR ENERGY CO.
To:
Shared Package
ML20137T636	List: 05000336/LER-1997-008, Forwards LER 97-008-00,documenting Event Occurred at Unit 2 on 970310.Commitments Made within Ltr Listed as Submitted 05000336/LER-1997-008-02, :on 970310,repts Review Facility Compliance W/ GL 96-01 for Reactor Protective Sys Received.Caused by Inadequate Program to Ensure Surveillance Procedures Fully Implement TS Requirements.Procedures Revised
References
GL-96-01, GL-96-1, LER-97-008-02, LER-97-8-2, NUDOCS 9704160147
Download: ML20137T699 (3)

LER-1997-008, on 970310,repts Review Facility Compliance W/ GL 96-01 for Reactor Protective Sys Received.Caused by Inadequate Program to Ensure Surveillance Procedures Fully Implement TS Requirements.Procedures Revised

Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(i) 10 CFR 50.73(a)(2)(viii) 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications
3361997008R02 - NRC Website

text

-~. -

NRC FDRM 366 U.S. NUCLEAR REGULATORY Commission APPROYED BY OMS NO. 3160-0104 (4-95) y EXPtRES 04/30/98 -

LICENSEE EVENT REPORT (LER)

Wo E E ' E "a E SI M $ 9 ' E "o^ E lia# 'a#?"@??o PaMrs'!124".ActsW'd "2deM (See reverse for re uired number of s

a to s

i digits / Characters for each block)

"^EEN' ^

'ES t*

F#,CIUTY NAME H)

DOCKET NL'MBER (2)

PAGE (3)

Millstone Nuclear Power Station Unit 2 05000336 1OF3 TITLE I4)

Insufficient Testing of RPS Logic Circuitry (Generic Letter 96 01 Review)

]

i EVENT DATE (5)

LER NUMBER (6)

REPORT DATE (7)

OTHER FACILITIES INVOLVED (8) 1 SEQU AL RE S N MONTH DAY YEAR YEAR MONTH DAY YEAR N

R i

03 10 97 97

-- 008 00 04 08 97 i

1 oPERATINo THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR 1: (Check one or more) (11)

Mo0E (9)

N 20.220)(b) 20.2203(a)(2)(v)

X 50.73(a)(2)(i) 50.73(a)(2)(viii) l POWER 20.2203(a)(1) 20.22o3(a)(3)(i)

So.73(a)(2)(ii)

So.73(a)(2)(x)

LEVEL (10) 000 20.2203ta)(2)(il 20.2203(a)(3Hii) so.73(a)(2)(iii) 73.71 20.22o3(a)(2)(ii) 20.2203(a)(4)

So.73(a)(2)(iv)

OTHER l

20.2203(a)(2)(iv)

So.36(c)(2)

So.73(a)(2)(vii) 9f NRC Fortn 366A j

LICENSEE CONTACT FOR THIS LER (12) i j

NAus rELEPHONE NUMBER Undude Area Codel j

i R. G. Joshi, MP2 Nuclear Licensing (860) 440-2080 I

COMPLETE ONE LINE FOR EACH COMPONENT FAILURE DESCRIBED IN THIS REPORT (13)

[O

CAUSE

SYSTEM COMPONENT MANUFACTURER

CAUSE

SYSTEM COMPONENT MANUFACTURER NPRD i

1 i

l SUPPLEMENTAL REPORT EXPECTED (14)

EXPECTED MonrH DAY YEAR YES Submission i

X No DATE (15) i (if yes, Complete EXPECTED sVBMisslON DATE).

ABSTRACT ILimit to 1400 spaces, i.e., approximately 15 single spaced typewritten lines) (16) l On March 10,1997 at 1030 hours0.0119 days <br />0.286 hours <br />0.0017 weeks <br />3.91915e-4 months <br />, the first of two reports which review the facility's compliance with Generic Letter 96-01 for the Reactor Protective System (RPS) was received. This report determined that all of the circuits within

{

the Reactor Protective System (RPS) were not being properly verified during surveillance activities. Three "K" relays which control the ladder network for the 2 out of 4 logic to trip the reactor and provide status indication (red lamp on the bistable) were not being properly verified. The fourth "K" relay, which controls an annunciator window, was being properly verified to ensure it drops-out when voltage is removed. At the time of discovery of this event, the reactor i

was defueled.

4 The cause of the event was an inadequate program to ensure surveillance procedures fully implement Technical Specification requirements.

To correct the deficiency, the procedures for the bistables will be enhanced to check the red status lamps on the bistables and a review of the facility surveillance procedures will be performed to ensure they comply with the r

Technical Specification surveillance requirements.

1 9704160147 970408 PDR ADOCK 05000336 i

S pon 1

l NRC FORM 386 (4-95)

l U.s. NUCLEAR REGULATORY COMMisslON NRC FdRM 366A

' (4.ee UCENSEE EVENT REPORT (LER)

TEXT CONTINUATION

~

DOCKET LER NUMBER 16)

PAGE (3)

FACILITY NAME (1)

SEQUENTIAL REVislON A

NUM8ER NUMBER 2OF3 Millstone Nuclear Power Station Unit 2 05000336 f

008 -

00 97 TEXT (It more space is required, use addit 15al copies of NRC Form 366A) (17) 1.

Description of Event

On March 10,1997 at 1030 hours0.0119 days <br />0.286 hours <br />0.0017 weeks <br />3.91915e-4 months <br />, the first of two reports which review the facility's compliance with Generic Letter 96-01 for the Reactor Protective System (RPS) [JC] was received. This report determined that all of the circuits within the RPS were not being properly verified during surveillance activities. Three *K" relays [RLYJ which control the ladder network for the 2 out of 4 logic to trip the reactor (RCT] and provide status indication (red lamp on the bistable) were not being properly verified. The fourth "K" relay, which controls an annunciator window, was being properly verified to ensure it drops-out when voltage is removed. At the time of discovery of this event, the reactor was defueled.

The report identifi0d that two tests are performed which involve the "K" relays coils [CL] and contacts. The first test, a bistable trip test, verifies that the bistables trip at the pre-trip and trip setpoints. Verification of the pre-trip and trip setpoints is done using annunciator windows on the main control board. The pre-trip alarm is controlled by a different circuit than the trip alarm. The trip alarm circuitry controls four "K" relays. Three of the four "K" relays provide logic for the matrix which forms the 2 out of 4 logic to trip the reactor. The relay contacts also provide a led status light [lL] Indication of the trip condition on the front of the bistable. The fourth "K* lefay provides the annunciator alarm on the main control board. This test did not verify that the red status lights were lit when the annunciator window alarmed at the bistable trip setpoint.

The second test, a logic matrix test, verifies that all the matrix combdations are working property. During this test each of the "K" relays contacts, except for "K4" which activates the annunciator alarm, is tested to ensure they work properly. Each of the three "K" relays (K1, K2 and K3) are tested separately. To accomplish the test a

" bucking coil

• which is ene gzed in the reverse direction of the "K" relay is used. This action removes the field from the "K" relay and its w tacts change state. The matrix contact combination and the red status light are verified. However, since tue "K" relay remains energized, the test does not verify that the contacts change state when the "K" relay is de-energized.

This event is being reported in accordance with 10CFR50.73(a)(2)(i)(B), any operation or condition prohibited by the plant's Technical Specification.

II. Cause of Event

The cause of the event was an in3quate program to ensure surveillance procedures fully implement Technical Specification requirements.

The monthly functional test failed to verify that the red status lights on the bistable trip unit were on when the bistable was in the trip condition. This is the only method which would have provided positive assurance that the three "K" relays (K1, K2 and K3) were de-energized.

Ill. Analysis of Event The RPS monitors the Nuclear Steam Supply System to effect a reactor shutdown if conditions deviate from a preset operating range. The 'K" relays form the matrix wh!ch provides a 2 out of 4 logic to trip the reactor. The red status light indication un the front of a bistable is an indication that the bistable has tripped. A tripped bistable means that the "K" Mays have de-energized, and the contacts have changed state. Although the red status ligM wera r.ut ve:ified during the functional test of the bistables, the red lights are normally used by the instrument and Control Technician and the Reactor Operator to verify that the bistable has tripped. All four "K" relays are controlled by the same device. The fourth "K" relay is indicated by a control board annunciator. The WAC FORM 366A (4-95)

,U.S. NUCLEAR REGULATORY COMMisslON i 4 951 LICENSEE EVENT REPORT (LER)

TEXT CONTINUATION FACILITY NAME (1)

DOCKET LER NUMBER i 6)

PAGE (3)

SEQUENTIAL REVislON YEAR NUiABER NUMBER 3OF3 Millstone Nuclear Power Station Unit 2 05000336 97

-- 008 -

00 TEXT (If mere space is required, use additional copies of NRC Form 366A) (17) remaining three relays are indicated by three separate red status lamps. Once the annunciator is acknowledged the operator verifies that the bistable has tripped by viewing the three red status lights on the front of the bistable.

Based on the above, this event is not considered to be safety significant.

IV. Correctise Action As a result of this event, the following actions have been, or will be, performed.

1.

The surveillance procedures for testing the bistables will be revised prior to entry into Mode 4 from the current outage to verify the red status lamps on the bistables.

2.

The facility Generic Letter 96-01 review, which will verify that s!I circuits are tested properly from the detector to the Reactor Trip circuit breakers, shall be completed prior to entry into Mode 4 from the current outage.

3.

In the response to NOV 336/96-08-07 (NNECO Commitment No. B16076-2), Millstone Unit No. 2 committed to perform a review of Technical Specification surveillance procedures to ensure compliance with Technical Specification surveillance requirements as part of the Operational Readiness Plan.

V.

Additional information

Similar Events Previous similar events irvolving the facility review of Generic Letter 96-01:

LER 96-035 - Identified that both bistables (one for each facility) were not verified for a Main Steam Isolation (MSI) signal for the Engineered Safety Actuation Feature System. An MSI signal is sent to both facility bistables to ensura a single failure will not cause an actuation and the functional test did not verify both bistables, only the bistable for the facility under test.

Energy Industry identification System (Ells) codas are identified in the text as [XX].

NRC FORM 306A (4-95)