05000247/LER-2015-003

LER-2015-003, Manual Reactor Trip Due to Indications of Multiple Dropped Control Rods Caused by Loss of Control Rod Power Due to a Power Supply Failure

Indian Point 2
Event date:	12-05-2015
Report date:	02-03-2016
Reporting criterion:	10 CFR 50.73(a)(2)(iv)(B), System Actuation 10 CFR 50.73(a)(2)(iv)(A), System Actuation
2472015003R00 - NRC Website

LER 15-003-00 for Indian Point, Unit 2, Regarding Manual Reactor Trip Due to Indications of Multiple Dropped Control Rods Caused by Loss of Control Rod Power Due to a Power Supply Failure

ML16041A018
Person / Time
Site:	Indian Point
Issue date:	02/03/2016
From:	Coyle L Entergy Nuclear Operations
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
NL-16-010 LER 15-003-00
Download: ML16041A018 (8)

Note: The Energy Industry Identification System Codes are identified within the brackets {}.

DESCRIPTION OF EVENT

On December 5, 2015, control room operators {NA} initiated a manual reactor trip (RT) {AA after observing indications consistent with multiple dropped control rods (CR) A (lowering RCS temperature, Power Range indication) following an alarm for the trip of Motor Control Center (MCC) 24/24A {MCC}. No Control Rod indication of control rod position was available due to de-energized MCC-24. All primary safety systems functioned properly except the primary rod control cabinet power supply (PS1) {JX} which was in a degraded condition prior to the event and failed to function as required. The plant was stabilized in hot standby with decay heat being removed by the main condenser {SG}. There was no radiation release. The Emergency Diesel Generators {EK} did not start as offsite power remained in-service. Main Feedwater {SJ} isolated and the Auxiliary FW system {BA} automatically started as designed. Unexpected response was the 21 Main Boiler Feedwater Pump (MBFP) High and Low Pressure steam stop valves failed to close. A post transient evaluation was performed prior to restart.

The event was recorded in the Indian Point Energy Center corrective action program (CAP) as CR-IP2-2015-05458.

Prior to the event all Control Rods were fully withdrawn from the reactor core and in Auto, both MBFPs ISJI were in service, Auxiliary Feedwater Pumps (AFWPs) {BA} were in standby, the emergency diesel generators (EDGs) {EK} were in standby, and off-site power was available. The plant was operating with a known degraded Rod Control power supply (PS1) which was discovered by operations personnel during rounds on October 11, 2015, when power cabinet 2BD Power Supply Failure light was lit. However, the Rod Control Non-Urgent Failure 1-6 annunciator remained clear. The failure of a Rod Control Power Cabinet Redundant Power Supply is indicated by the Power Supply Failure light being lit and the Rod Control Non-Urgent Failure Alarm being annunciated however, this alarm did not come up. Investigation determined that at least one power supply was verified as being available for Power Cabinet 2BD and all other failure alarms associated with Power Cabinet 2BD remained clear.

On December 5, 2015, at 1721 hours0.0199 days <br />0.478 hours <br />0.00285 weeks <br />6.548405e-4 months <br />, the control room received alarm SHF (Motor Control Center 24/24A 52/MCC 24/24A Auto Trip). Following the trip of MCC-24 and MCC-24A the plant initially remained stable. After approximately 10 minutes the Control Room observed indications that there were multiple dropped Control Rods.

Investigation in the plant and visual inspection of MCC24 revealed that cubicle 2H (21 Roof Fan) was heavily damaged from heat with evidence of arcing due to melting of some non-metallic parts of the disconnect switch for the cubicle. The line side leads were nearly completely disintegrated. Visual inspection of the MCC Bus found no evidence of bus or control wiring overheating or damage. MCC24 cubicle 2H houses a fused, 3-phase disconnect switch, motor starter and an internal control power transformer which steps the 480 volt supply power down to 120 volt AC control power. The 50 ampere fuses in the compartment were found blown. The roof vent fan and associated wiring served by this Motor Control (2H) were tested and found to be un-faulted.

The primary function of the Rod Control System is to provide automatic control of the rod clusters during power operation of the reactor. Overall reactivity control is achieved by the combination of chemical shim and 53 control rod clusters of which 29 are in control bank and 24 are in shutdown bank. The control rod drive system is designed such that the control rods are held in place and are capable of being moved only when its power supply is energized. Two reactor trip breakers placed in series with the control rod drive power supply remain closed as long as their respective under voltage coils are kept energized by the reactor protection system logic buses.

FACILITY NAME (1) DOCKET (2) LER NUMBER (6) PAGE (3) Control Rod Power Supply (PS1) {JX} in cabinet 2BD is a model LM-E24 manufactured by Lambda {L045} installed in November 2004. A 12 year replacement preventive maintenance (PM) is in place for these power supplies. The last performance for proper output per PM CRDLOGIC (4 Year Full Length Rod control System PM) was on March 5, 2014 with satisfactory results. The current PM frequency for PS1 agrees with the Entergy fleet and industry operating events (0Es). The PM Program is a living program and Indian Point uses plant operating experience to change PM intervals commensurate with operating history and industry recommendations. Therefore, it is prudent to consider a more conservative replacement frequency based on this event.

The failure of MCC24-2H compartment (bucket) was the result of line side wiring (supply) in contact with MCC compartment mounting plate due to lack of adequate clearance. MCC24 is a Westinghouse {W120} Type W Motor Control Center {MCC}. MCC24A which is electrically connected to MCC24 via 480 volt AC supply breaker 52/MCC4A is a different design which does not incorporate a mounting plate. This type of event has not previously occurred at Indian Point and is an uncommon event within the industry.

Most MCC faults occur at a particular load and the fault is isolated by fuses in the associated MCC cubicle where the remainder of, the MCC is unaffected. The coordination/protection for MCCs at Indian Point are designed such that individual load faults are instantaneously isolated minimizing effects to the plant and maintaining operation of the remaining loads on the MCC. Thermography scans performed in accordance with PM did not show any signs of overheating (line side wiring degradation).

An extent of condition (EOC) review will be performed of other MCCs of the same type and design. All compartments in MCC24 were visually inspected. No similar conditions (line wires in contact with mounting plate) were found. There are no additional concerns with MCC24. MCC24A which is electrically connected to MCC24 is a different design which does not incorporate a mounting plate.

Cause of Event

The direct cause of the event was loss of MCC24 and MCC24A due to an internal fault at the line side leads at cubicle 2H where they connect to the bus stab assemblies. This caused the supply breaker feed to open per design and clear the fault. The de- energization of MCC-24 removed the functioning backup Control Rod power supply (PS2) and the remaining degraded primary power supply (PS1) failed to function as required.

The line leads, which were obstructed by a compartment mounting plate, did not route freely to the disconnect switch resulting in contact. This configuration was from original construction.

The apparent cause was an unanticipated loss of power to the Control Rod System due to the degradation of the primary Control Rod power supply (PS1) which failed to function when the operating power supply (PS2) was lost. MCC-24/24A was lost due a design error that allowed the positioning of a mounting plate too close and obstructing the line side wiring resulting in contact. Vibration over time resulted in degraded wiring insulation which eventually shorted. The failure of PS1 is considered unanticipated. The power supply was within its 12 year replacement PM frequency and had tested satisfactorily on March 5, 2014.

Corrective Actions

The following corrective actions have been or will be performed under Entergy's Corrective Action Program to address the cause and prevent recurrence:

• MCC24 compartments 2H, 2K, and 2F were removed to facilitate inspection and testing of the MCC bus, control wires and MCC internal. All conditions were satisfactory.

The bus and control wiring were megger tested with acceptable results. A new bucket will be assembled for MCC-2H (21 Roof Vent Fan). MCC24-2K (22 Roof Vent Fan) will have a PM performed and installed into MCC24. MCC-2F (Isophase Fan motor) was cleaned, inspected, and a PM performed prior to returning to service.

• The degraded Rod Control power supply (PS1) was replaced.

• Applicable maintenance procedures will be revised to provide more in-depth inspection criteria.

• An action request (AR) will be created and implemented to increase the PM frequency, for the. Rod Control power supplies based on vendor recommendations and operating history (intent is to ensure the PM frequency is conservative in regards to the lifespan of the power supplies as a result of the failure).

Event Analysis

The event is reportable under 10CFR50.73(a)(2)(iv)(A). The licensee shall report any event or condition that resulted in manual or automatic actuation of any of the systems listed under 10CFR50.73(a)(2)(iv)(B). Systems to which the requirements of 10CFR50.73(a)(2)(iv)(A) apply for this event include the Reactor Protection System including reactor trip and AFWS actuation. This event meets the reporting criteria because a manual reactor trip was initiated at 1731 hours0.02 days <br />0.481 hours <br />0.00286 weeks <br />6.586455e-4 months <br />, on December 5, 2015, and the AFWS actuated as a result of the RT. On December 5, 2015, at 18:48 hours, a four hour non-emergency notification was made to the NRC (Log Number 51586) for a reactor trip while critical and included the eight hour non-emergency notification for the actuation of the AFW system. The RT notification was in accordance with 10CFR50.72(b)(2)(iv)(B) and the AFWS actuation notified in accordance with 10CFR50.72(b)(3)(iv)(A). The event was recorded in the Indian Point Energy Center, corrective action program (CAP) as CR- IP2-2015-05458.

Past Similar Events

A review of the past three years of Licensee Event Reports (LERs) for events that involved a RT from dropped control rods did not identify an applicable LER.

Safety Significance

This event had no effect on the health and safety of the public.

There were no actual safety consequences for the event because the rod control system and RPS operated as designed. Control rod design is to fail safe upon loss of power.

The inadvertent loss of power to the operating power supply (PS2) in Rod Control Cabinet 2BD resulted in switching to the alternate power supply (PS1) which was degraded. PS1 operated for approximately 10 minutes then failed causing the control rod stationary grippers to de-energize and rods to insert into the core. Control room indications and alarms alerted operators to the condition and a reactor trip was initiated inserting all control rods into the core through manual actuation of the RPS. The requirement to trip the reactor as a result of multiple dropped rods is contained in plant procedures. The event did not initiate any transients or accidents and the plant safely shut down as designed.

FACILITY NAME (1) DOCKET (2) LER NUMBER (6) PAGE (3) Indian Point Unit 2 05000-247 2015 There were no significant potential safety consequences of this event.

The Reactor Protection System (RPS) is designed to actuate a RT for any anticipated combination of plant conditions, when necessary, to ensure a minimum departure from nucleate boiling (DNB) ratio (DNBR) equal to or greater than the applicable safety analysis limit DNBR. The RPS monitors parameters related to safe operation and trips the reactor to protect the reactor core against fuel rod cladding damage caused by DNB, and to protect against reactor coolant system damage caused by high system pressure.

DNB is prevented by the RPS by monitoring plant variables affecting DNB [i.e., thermal power, coolant flow, coolant temperature, coolant pressure, core power distribution (hot channel factors)] and initiating a RT when applicable limits are reached. Plant parameters used to protect against DNB include the Overtemperature Delta Temperature trip, the Low Pressurizer Pressure trip to protect against excessive core voids that could lead to DNB, and the Overpower Delta Temperature trip to protect against excessive power (fuel rod rating protection) all of which initiate a RT. In addition, a manual RT can be initiated by control room operators based on two independent systems that are provided to sense dropped rods; 1) a rod bottom position detection system and, 2) a system that uses ex-core power range detectors which senses sudden reduction in ex-core neutron flux. Dropped Rods will rapidly depress the local neutron flux which will be detected by one of the four ex-core detectors. The reactivity control system is composed of RCCAs divided into control banks and shutdown banks. The control banks are used in combination with chemical shim (boric acid) control to provide control of reactivity changes. The shutdown banks are provided to supplement the control banks of RCCAs to make the reactor at least 1.3 percent subcritical following RT from any.

credible operating condition assuming the most reactive RCCA is in the fully withdrawn position. Sufficient shutdown capability is provided so that the minimum DNBR is equal to or greater than the applicable safety analysis limit DNBR, assuming the most reactive rod to be in the fully withdrawn position for the most severe anticipated cooldown transient associated with a single active failure. The RPS is designed so that the most probable modes of failure in each protection channel result in a signal calling for the protective trip. The RPS design is of sufficient redundancy and independence to assure that no single failure or removal from service of any component or channel will result in loss of the protection function.

The protection system design is to fail into a safe state or state established as tolerable. Rapid reactivity shutdown is provided by the insertion of RCCAs by gravity fall. Duplicate series-connected circuit breakers supply all power to the control rod drive mechanisms. The reactor uses magnetic-type control rod drive mechanisms which must be energized for the RCCAs to remain withdrawn from the core. The RCCAs fall by gravity into the core upon loss of power to the control rod drive mechanism coils. RT breakers (RTB) which provide power to the control rod drive mechanism coils and are opened by undervoltage coils on both RTBs (normally energized), become de-energized by any of several RT signals. The electrical state of the devices providing signals to the circuit breaker undervoltage trip coils is such as to cause these coils to trip the breaker in the event of RT or power loss. RT is implemented by interrupting power to the magnetic latch mechanisms on all control rod drives allowing the RCCAs to insert into the core by gravity.

In addition to automatic RT by the RPS, manual RT is also available. Manual RT for multiple dropped rods is required by plant procedures and operator training includes scenarios of multiple dropped rods. The manual RT actuating devices are independent of the automatic trip circuitry and are not subject to failures that could make the automatic circuitry inoperable. All components in the RCS were designed to withstand the effects of cyclic loads due to reactor system temperature and pressure changes.

For this event, rod control was in automatic and all rods inserted upon initiation of a RT. The AFWS actuated and provided required FW flow to the SGs. RCS pressure remained below the set point for pressurizer PORV or code safety valve operation and above the set point for automatic safety injection actuation. Following the RT, the plant was stabilized in hot standby.