05000247/LER-2016-009, Regarding Automatic Reactor Trip Due to Actuation of the Trip Logic of the Reactor Protection System During Preparation for Testing
| ML16256A780 | |
| Person / Time | |
|---|---|
| Site: | Indian Point  |
| Issue date: | 09/06/2016 |
| From: | Vitale A Entergy Nuclear Operations |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| NL-16-090 LER 16-009-00 | |
| Download: ML16256A780 (8) | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(ii)(A), Seriously Degraded 10 CFR 50.73(a)(2)(viii)(A) 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition 10 CFR 50.73(a)(2)(viii)(B) 10 CFR 50.73(a)(2)(ix)(A) 10 CFR 50.73(a)(2)(iv)(A), System Actuation 10 CFR 50.73(a)(2)(x) 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor 10 CFR 50.73(a)(2)(v)(B), Loss of Safety Function - Remove Residual Heat 10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(i)(A), Completion of TS Shutdown 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability 10 CFR 50.73(a)(2)(i) 10 CFR 50.73(a)(2)(iv)(B), System Actuation |
| 2472016009R00 - NRC Website | |
text
-===-Entergy NL-16-090 September 6, 2016 U.S. Nuclear Regulatory Commission Attn: Document Control Desk Mail Stop O-P1-17 Washington, D.C. 20555-0001 Indian Point Energy Center 450 Broadway, GSB P.O. Box249 Buchanan, N.Y. 10511-0249 1 Tel (914) 254-6700 Anthony J. Vitale Site Vice President
SUBJECT:
Licensee Event Report# 2016-009-00 "Automatic Reactor Trip due to Actuation of the Trip Logic of the Reactor Protection System During Preparation for Testing" Indian Point Unit No. 2 Docket No. 50-247 DPR-26
Dear Sir or Madam:
Pursuant to 1 O CFR 50. 73(a)(1 ), Entergy Nuclear Operations Inc. (ENO) hereby provides Licensee Event Report (LER) 2016-009-00. The attached LER identifies an event where the reactor automatically tripped, which is reportable µnder 10 CFR 50. 73(a)(2)(iv)(A). As a result of the reactor trip, the Auxiliary Feedwater System was actuated, which is also reportable under 10 CFR 50. 73(a)(2)(iv)(A). This condition was recorded in the Entergy Corrective Action Program as Condition Report CR-IP2-2016-04320.
_J
NL-16-090 Docket No. 50-247 Page 2 of 2 There are no new commitments identified in this letter. Should you have any questions regarding this submittal, please contact Mr. Robert Walpole, Manager, Licensing at (914) 254-6710.
Sincerely, AJV/cbr cc:
Mr. Daniel H. Dorman, Regional Administrator, NRC Region I NRC Resident Inspector's Office Ms. Bridget Frymire, New York State Public Service Commission
NRC FORM366 U.S. NUCLEAR REGULATORY APPROVED BY OMB: NO. 3150-0104 EXPIRES: 10/31/2018 (11-2015)
COMMISSION
, the NRG may not conduct or sponsor, and a person is not required to respond to, the information
- -11 --~: *-
r* PAGE Indian Point 2 05000-247 1 OF 6
- 14. TITLE: Automatic Reactor Trip Due to Actuation of the Trip Logic of the Reactor Protection System During Preparation for Testing
- 5. EVENT DATE
- 6. LER NUMBER
- 7. REPORT DATE
- 8. OTHER FACILITIES INVOLVED MONTH DAY YEAR YEAR I SEQUENTIAL I REV MONTH DAY YEAR FACILITY NAME DOCKET NUMBER NUMBER NO.
FACILITY NAME DOCKET NUMBER 7
6 2016 2016 009 00 9
6 2016
- 9. OPERATING MODE
- 11. THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR §: (Check all that applv)
D 20.2201(b)
D 20.2203(a)(3)(i)
D 50.73(a)(2)(ii)(A)
D 50.73(a)(2)(viii)(A) 1 D 20.2201 (d)
D 20.2203(a)(3)(ii)
D 50.73(a)(2)(ii)(B)
D 50.73(a)(2)(viii)(B)
.0 20.2203(a)(1)
D 20.2203(a)(4)
D so.73(a)(2)(iii)
D 50.73(a)(2)(ix)(A)
D 20.2203(a)(2)(i)
D 50.36(c)(1 )(i)(A)
~ 50.73(a)(2)(iv)(A)
D 50.73(a)(2)(x)
- 10. POWER LEVEL D 20.2203(a)(2)(ii)
D 50.36(c)(1)(ii)(A)
D 50.73(a)(2)(v)(A)
D 73.71 (a)(4)
D 20.2203(a)(2)(iii)
D so.36(c)(2)
D 50.73(a)(2)(v)(B)
D 73.71 (a)(s) 100%
D 20.2203(a)(2)(iv)
D so.46(a)(3)(iil D 50.73(a)(2)(v)(C)
D 73.77(a)(1)
D 20.2203(a)(2)(v)
D 50.73(a)(2)(i)(A)
D 50.73(a)(2)(v)(D)
D 73.77(a)(2)(i)
D 20.2203(a)(2)(vi)
D 50.73(a)(2)(i)(B)
D 50.73(a)(2)(vii)
D 73.77(a)(2)(ii)
D 50.73(a)(2)(i)(C) 00THER Specify in Abstract below or in An I&C technician signaled the other I&C technician that was at the RTBs to test the key.
Without using a procedure or an approved work instruction, the other I&C technician positioned the Train B bypass key switch to defeat.
Because reactor trip Bypass Breaker B was in the racked out position, when the train B bypass key switch was taken to the Defeat position, it caused the normal Reactor Trip Breaker B to open, which initiated a reactor trip (RT) at approximately 9:38 hours.
00 All control rods {AA} fully inserted and all required safety systems functioned properly.
The plant was stabilized in hot standby with decay heat being removed by the condenser {sG}.
The auxiliary feedwater system {BA} actuated as expected due to steam generator low level from shrink effect.
Normally during performance of the test, the train B bypass key switch is only positioned to Defeat after Bypass Breaker B has been closed and the Reactor Trip Breaker B-has been opened.
The condition was recorded in the Indian Point Energy Center (IPEC) Corrective Action Program (CAP) in gondition Report CR-IP2-2016-04320..
The reactor protection system (RPS) {JC} initiates a reactor shutdown, based on values of selected unit parameters, to protect against violating the core fuel design limits and reactor coolant system pressure boundary during anticipated operational occurrences and to assist the Engineered Safeiy Feature Systems in mitigating accidents.
The RPS instrumentation is segmented into four distinct but
,interconnected modules one of which is reactor trip switchgear that i:r;icludes the reactor trip breakers (RTBs) and Bypass Breakers.
These-components p*rovide a means to interrupt power to the control rod drive mechanisms (CRDMs) and allows the rod cluster control assemblies (RCCAs) or rods to fall into the core and shut down the reactor.
The bypass breakers allow testing of the RTBs at power.
The control rod drive system is designed such that the control rods are held in place and are capable of being moved only when its power supply is energized.
Two RTBs placed in series with the control rod drive power supply remain closed as long as their respective under-voltage coils are kept energized by the RPS logic buses.
Two bypass breakers are provided to allow in service testing of either RTE.
The key-interlock switch is provided such that if both bypass breakers are closed at the same time while racked in, both bypass breakers will be tripped.
This interlock is defeated in the test position with the key to allow for tripping of the undervoltage device of the bypass breaker when the reactor is in operation.
The key interlock switch at the Reactor Trip Switchgear is placed in the Defeat position to prevent repeated breaker operation as the logics are tripped and reset.
During normal testing of the RPS Logic, the bypass breaker is racked in and closed and the key-interlock switch would then only bring in the alarm in the Control Room supervisory annunciator.
For this event the bypass breaker was not racked in (closed).
NRC FORM 366 (11-2015)
- J
The bypass breakers must be manually closed and under no circumstances should both bypass breakers be racked in and closed at the same time.
During normal testing of Channel B, the associated key-interlock switch would have been placed in the defeat position.
This would have resulted in: 1) Illuminating a red light on the Train B cabinet, 2) Annunciating an alarm RTB & BYA Train B Defeat on the Control Room supervisory annunciator, 3) Opened up the closing circuit of RTB which is being tested, 4) Opened up the coil circuit of undervoltage trip devices for breakers RTB and BYA which is being tested and preventing the unit from tripping.
In this event the key bypass switch was turned to the defeat position while the Bypass Breaker was still racked out (open) which de-energized the undervoltage coil for the B RTB which caused it to open and trip the unit.
An extent of condition (EOC) review determined the condition is bounded to only the RTBs because they are the only breakers with a key-interlocked switch such that if both bypass breakers are closed at the same time while racked in, both bypass breakers will be tripped.
The test procedure for unit 2 calls for key number 182, 184 or allows for an equivalent key to be used.
This is vague guidance unlike unit 3 which only has one key.
The Unit 2 test procedure 2-PT-2M3A will be revised to remove "equivalent."
CAUSE OF EVENT
The direct cause of the RT was due to operating the "B" RPS bypass key out of sequence during Reactor Protection logic testing.
An I&C technician turned the key interlock to defeat on switchgear Channel B Reactor Protection Logic without having the BYB Bypass Breaker racked in and closed, which opened the undervoltage tripping device of the RTB and tripped the reactor.
The I&C technician turned the key without procedural guidance.
The I&C technicians were testing the key with verbal guidance from operations, due to vague procedure guidance in 2-PT-2M3A, that allowed an equivalent key to be used (number 183).
Due to not stopping when unsure (conservative decision making), the I&C technicians tested the key prior to starting the surveillance because of perceived time pressure.
The root cause (RC) of the event was that IPEC personnel emphasized work culture production goals for productivity, schedule adherence, and backlog reduction without fully recognizing the need to maintain fundamental standards and expectations for nuclear workers, such as procedure use and adherence and staying in process during work activities.
The RC resulted in the I&C technician turning the key without procedure guidance or work instructions and tripped the plant.
CORRECTIVE ACTIONS
The following corrective actions have been or will be performed under the Corrective Action Program (CAP) to address the causes of this event:
Site all-hands meeting was held to discuss the event, the lessons learned, and to reinforce expectations.
NRC FORM 366 (11-2015)
Site All-hands meeting was held to discuss the Fleet Refocus Initiative.
Conducted Fleet Refocus Initiative Small Group Meetings.
Implemented observation activities from the Fleet Refocus Initiative.
As an interim action all essential work that effects generation was to have direct oversight by a superintendent or above.
All work start authorizations provided by operations watch personnel must now undergo an additional work challenge utilizing a checklist developed in response to this event.
Revised process was formalized by an Operations Standing Order.
The completion of corrective actions associated with the Fleet Refocus Observation Program will be documented to ensure all personnel apply the essential knowledge, skills, behaviors and practices needed to conduct work safely and reliably.
Procedures 2-PT-2M3, 2-PT-2M2, and 2-PT-2M2A will be.revised to remove the word "equivalent" to prevent any questions on which key to use.
EVENT ANALYSIS
The event is reportable under 10CFR50.73(a) (2) (iv) (A).
The licensee shall report any event or condition that resulted in manual or automatic actuation of any of the systems listed under 10CFR50.73(a) (2) (iv) (B).
Systems to which the requirements of 10CFR50.73(a) (2) (iv) (A) apply for this event include the Reactor Protection System including reactor trip and AFWS actuation.
This event meets the reporting criteria because an automatic reactor trip was initiated at 9:38 hours, on July 6, 2016, and the AFWS actuated as a result of the RT.
On July 6, 2016, at 13:16 hours, a four hour non-emergency notification was made to the NRC (Log Number 52067) for an automatic reactor trip while critical and included the eight hour non-emergency notification for the actuation of the AFW system.
Both notifications were in accordance with 10CFR50.72(b) (3) (iv) (A).
The event was recorded in the Indian Point Energy Center corrective action program (CAP) as CR-IP2-2016-04320.
As all primary safety systems functioned properly there was no safety system functional failure reportable under 10CFRS0.73(a) (2) (v).
PAST SIMILAR EVENTS A review was performed of the past three years of Licensee Event Reports (LERs) for events that involved a reactor trip due to testing of the reactor protection system.
No applicable LERs were identified.
SAFETY SIGNIFICANCE
This event had no effect on the health and safety of the public.
This condition had no effect on the health and safety of the public.
There were no actual safety consequences for the event because the event was an uncomplicated reactor trip with no other transients or accidents.
NRC FORM 366 (11-2015)
Required primary safety systems performed as designed when the RT was initiated.
AFWS actuation was an expected reaction as a result of low SG water level due to void fraction (shrink), which occurs after a RT and main steam back pressure as a re.sul t of the rapid reduction of steam flow due to turbine control valve closure.
For this RT there was no actual condition to initiate the reactor trip breaker opening.
Event was initiated by human error.
00 The SG There were no significant potential safety consequences of this event.
The RPS is designed to actuate.a RT for any anticipated combination of plant conditions to include low SG level.
All components in the RCS were qesigned to withstand the effects of cyclic loads due to reactor system temperature and pressure changes.
The reactor trip breakers (RTBs) are in the electrical power supply line from the control rod drive motor generator set power supply to the CRDMs.
Opening of the RTBs interrupts power to the CRDMs, which allows the shutdown rods to fall into the core by gravity.
Each reactor trip breaker (RTB) is equipped with a reactor trip bypass breaker (RTBB) to allow testing of the trip breaker while the unit is at power.
Each RTB and RTBB is equipped with an undervoltage coil and a shunt trip coil to trip the breaker open when needed.
The reactor trip signals generated by the RPS automatic trip logic cause the RTBs and associated RTBB to open and shut down the reactor.
There are two RTBs in series so that opening either will interrupt power to the rod control system and allow the control rods to fall into* the core and shut down the reactor.
Each RTB has a parallel RTBB that is normally open.
This feature allows testing of the RTBs at power.
A trip signal from RPS logic train A will trip RTB A and RTBB B; and a trip signal from logic train B will trip RTB B and RTBB A.
During normal operation, both RTBs are closed and both RTBBs are open.
When any one train is taken out of service for testing, the other train is capable of providing unit monitoring and protection until the testing has been completed.
For this event, rod control was in automatic and all rods inserted upon initiation of a RT.
The AFWS actuated and provided required FW flow to~the SGs.
RCS pressure remained below the set point for pressurizer PORV or code safety valve operation and above the set point for automatic safety injection actuation.
Following the RT, the plant was stabilized in hot standby.
NRC FORM 366 (11-2015)