05000286/LER-2014-004

LER-2014-004, Automatic Reactor Trip as a Result of Meeting the Trip Logic for Over Temperature Delta Temperature during Reactor Protection System Pressurizer Pressure Calibration

Indian Point 3
Event date:	8-13-2014
Report date:	8-1-2016
Reporting criterion:	10 CFR 50.73(a)(2)(iv)(B), System Actuation 10 CFR 50.73(a)(2)(iv)(A), System Actuation 10 CFR 50.73(a)(2)(v), Loss of Safety Function
2862014004R01 - NRC Website

LER 14-004-01 for Indian Point Unit 3, Regarding Automatic Reactor Trip as a Result of Meeting the Trip Logic for Over Temperature Delta Temperature During Reactor Protection System Pressurizer Pressure Calibration

ML16224B012
Person / Time
Site:	Indian Point
Issue date:	08/01/2016
From:	Coyle L Entergy Nuclear Operations
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
NL-16-075 LER 14-004-01
Download: ML16224B012 (7)

Note: The Energy Industry Identification System Codes are identified within the brackets {}.

DESCRIPTION OF EVENT

On August 13, 2014, during 100% steady state reactor power, Instrumentation and Control (I&C) technicians started performance of an 8-hour scheduled surveillance 3-PC-OLO4A (Pressurizer Pressure Loop P-455 Channel Calibration) with Loop I in test and tripped. Loop I was left in test and tripped during an approved break by I&C and operations. During the break, an automatic reactor trip (RT) {JC} occurred at 11:57 hours as a result of meeting the 2/4 trip logic for the Reactor Protection System (RPS) {JC} function Overtemperature Delta Temperature (OTDT). All control rods {AA} fully inserted and all required safety systems functioned properly. The plant was stabilized in hot standby (Mode 3) with decay heat being removed by the main condenser {SG}. The Auxiliary Feedwater System {BA} automatically started as expected due to SG low level from shrink effect. The Emergency Diesel Generators {E10 did not start as offsite power remained available and stable. No work was being performed at the time of the RT and no actual OTDT existed. The event was recorded in the Indian Point Energy Center corrective action program (CAP) as CR- IP3-2014-01903. A post trip evaluation was completed on August 14, 2014.

The OTDT trip function is provided to ensure that the design limit Departure from Nucleate Boiling Ratio (DNBR) is met. The OTDT trip prevents the power density anywhere in the core from exceeding 118% of design power density. The inputs to the OTDT trip include pressure, coolant temperature, axial power distribution, and reactor power as indicated by loop delta Temperature assuming full reactor power.

Four different temperature channels are used, one for each coolant loop. The OTDT circuitry consists of four independent channels that feed the delta Temperature (dT) and dT setpoint signals into dual bistables which drive the reactor protection relays. Contacts from these relays are connected in the proper matrix for the reactor trip relays. A trip actuation requires a two out of four logic. ...The indicated loop dT is used in the RPS as a measure of reactor power. This is compared with a setpoint that is automatically calculated dependent on T(avg), pressurizer pressure, and axial power tilt. When the dT signal exceeds the calculated setpoint, the affected channel is then tripped.

On August 13, 2014, at 8:50 hours, I&C Technicians started 3-PC-OLO4A (Pressurizer Pressure Loop P-455 channel Calibration) for performance of a pressurizer pressure calibration. Operations entered the following Technical Specifications (TS): TS 3.3.2 (ESFAS Instrumentation) Function 7 (ESFAS Interlock-Pressurizer Pressure) Condition K (One or More Channels Inoperable), TS 3.3.1 (RPS Instrumentation) Function 5 (OTDT) and 7b (Pressurizer Pressure High) both Condition E (One Channel Inoperable), TS 3.3.2 (ESFAS Instrumentation) Function ld (Pressurizer Pressure- LowO Condition D (One Channel Inoperable). Required actions (Channels placed to trip) performed in body of test. Entered TS 3.3.4 PAOT Function 2a from TS Basis Table 3.3.4-1 (Remote Shutdown-Pressurizer Pressure) for calibration of Loop P-455 bistables. The test places protection channel 1 in trip and has a scheduled duration of 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. Due to the long duration of the test and vulnerability to un-trip and re-trip the protection channel, it is accepted work practice to leave a channel in trip for break periods. During an approved break from calibration, with all test equipment removed, bistables still tripped, Channel I in test, a RT occurred from Channel III of OTDT.

At 11:57 hours, Control Room Operators observed First Out Alarm OTDT RT/Turbine Trip. Entered procedure 3-E-0 (Reactor Trip or Safety Injection) and transitioned to 3-ES-0.1 (Reactor Trip Response). At 13:32 hours, operators transitioned to POP 3.2.

FACILITY NAME (1) DOCKET (2) LER NUMBER (6) PAGE (3) An extent of condition investigation determined that Unit 3 is susceptible to spurious OTDT trip during RPS testing which reduces the trip logic to 1 out of 3.

Unit 2 does not have this vulnerability as the Unit 2 RPS channels have a test bypass feature which maintains the trip logic and only reduces the number of channels.

The Cause of Event The direct cause of the RT was a spurious signal spiking on channel III of the OTDT circuitry with another channel tripped for testing. One channel was made up for testing, then a spurious intermittent spike caused another channel to make up thereby satisfying the logic for a RT. The origin of the spiking was identified as the axial power tilt portion of the channel III OTDT analog protection circuity.

There was two possible root causes (RC): 1) A possible RC of the Foxboro static gain unit is a random failure of the OTDT static gain unit (Foxboro S/N 2261888, Integrator/Converter module QM-331D) {CNV}. Failure analysis determined the static gain unit operational amplifier (A4) had failed which led to not being able to limit the output. The operational amplifier had a bad internal connection which was attributed to a random component failure, 2) A possible RC of the loose wiring connection on distribution DB-4, which is the output of the static gain unit QM-431D due to workmanship issue during the construction of the plant. Because RPS logic make-up was caused by a spurious intermittent spike, the trip would still have occurred even if the surveillance was worked continuously. Channel 4 has a bypass capability. Channel 1 for OTDT was tripped at the time for surveillance testing.

The Unit 3 design does not have the capability to place a channel in bypass except for channel 4. The condition results in a trip risk during surveillance testing since the reactor protection logic is reduced from a 2 out of 4, to a 1 out of 3 trip signals required for a RT. A bypass modification was not installed to alleviate the risk for testing channels 1, 2, and 3.

Corrective Actions

The following corrective actions have been or will be performed under the Corrective Action Program (CAP) to address the causes of this event.

• Three bistables.TC-421A/B (Channel II-Foxboro), TC-431A/B (Channel III-NUS), and TC-441A/B (Channel IV-Foxboro) were replaced with three NUS bistables.

• The removed bistables were sent to a vendor for a failure analysis. The analysis revealed no abnormalities with the bistables.

• Static gain module QM-431D and associated PR N-43 isolation amplifies NM306 and NM307 were replaced as well as static gain modules QM-421D, and QM-411D.

• Setpoint module TM-432B was replaced. Other setpoint modules had been previously replaced,

• The Loop 3 T(avg) E/I converter TM-432R was replaced.

• I&C and operations personnel were briefed and procedure IP-SMM-WM-140 (Surveillance Test Program) step Precautions and Limitations, revised to include the expectation that when a protection channel is tripped during surveillance testing or maintenance, and the margin to trip is reduced to a single component, extended breaks, such as turnover, lunch, etc., should be managed to minimize the time that the channel is tripped.

• Project prepared to complete the installation of trip bypass in the three remaining channels.

Event Analysis

The event is reportable under 10CFR50.73(a)(2)(iv)(A). The licensee shall report any event or condition that resulted in manual or automatic actuation of any of the systems listed under 10CFR50.73(a)(2)(iv)(B). Systems to which the requirements of 10CFR50.73(a)(2)(iv)(A) apply for this event include the Reactor Protection System (RPS) including RT and AFWS actuation. This event meets the reporting criteria because an automatic RT was initiated at 11:57 hours, on August 13, 2014, and the AFWS actuated as a result of the RT. On August 13, 2014, a 4-hour non-emergency notification was made to the NRC at 13:06 hours, for an actuation of the reactor protection system OCI while critical and included an 8-hour notification under 10CFR50.72(b)(3)(iv)(A) for a valid actuation of the AFW System (Event Log #50361).

As all primary safety systems functioned properly there was no safety system functional failure reportable under 10CFR50.73(a)(2)(v).

Past Similar Events

A review was performed of the past three years for Licensee Event Reports (LERs) reporting a RT as a result of testing. No LERs were identified.

Safety Significance

This event had no effect on the health and safety of the public.

There were no actual safety consequences for the event because the event was an uncomplicated reactor trip with no other transients or accidents. Required primary safety systems performed as designed when the RT was initiated. The AFWS actuation was an expected reaction as a result of low SG water level due to SG void fraction (shrink), which occurs after a RT and main steam back pressure as a result of the rapid reduction of steam flow due to turbine control valve closure. For this RT there was no actual OTDT condition.

There were no significant potential safety consequences of this event. The RPS is designed to actuate a RT for any anticipated combination of plant conditions to include low SG level. The reduction in SG level and RT is a condition for which the plant is analyzed. A low water level in the SGs initiates actuation of the AFWS.

Redundant safety SG level instrumentation was available for a low SG level actuation which automatically initiates a RT and AFWS start providing an alternate source of FW. The AFW System has adequate redundancy to provide the minimum required flow assuming a single failure. The analysis of a loss of normal FW (UFSAR Section 14.1.9) shows that following a loss of normal FW, the AFWS is capable of removing the stored and residual heat plus reactor coolant pump waste heat thereby preventing either over pressurization of the RCS or loss of water from the reactor. All components in the RCS were designed to withstand the effects of cyclic loads due to reactor system temperature and pressure changes. For this event, rod control was in automatic and all rods inserted upon initiation of a RT. The AFWS actuated and provided required FW flow to the SGs. RCS pressure remained below the set point for pressurizer PORV or code safety valve operation and above the set point for automatic safety injection actuation. Following the RT, the plant was stabilized in hot standby.