05000285/LER-2016-003

LER-2016-003, Unplanned Turbine Trip during DCS Modification due to Failure to Identify and Disable the Transmitter Deviation Based Trip

Fort Calhoun Station
Event date:	06-22-2016
Report date:	08-22-2016
Reporting criterion:	10 CFR 50.73(a)(2)(iv)(A), System Actuation
2852016003R00 - NRC Website

LER 16-003-00 for Fort Calhoun, Unit 1, Regarding Unplanned Turbine Trip During DCS Modification Due to Failure to Identify and Disable the Transmitter Deviation Based Trip

ML16235A500
Person / Time
Site:	Fort Calhoun
Issue date:	08/22/2016
From:	Marik S M Omaha Public Power District
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
LIC-16-0075 LER 16-003-00
Download: ML16235A500 (5)

comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

Fort Calhoun Station 05000-285

3. LER NUMBER

2016 - 00 003

BACKGROUND

Fort Calhoun Station (FCS) is a two-loop reactor coolant system (RCS) of Combustion Engineering design. Fort Calhoun Station replaced the original General Electric (GE) Mark I turbine control system with a Foxboro digital Turbine Control System (TCS) per engineering change (EC) 32387 in April 2011. The system was placed into service in December 2013. The turbine trip logic loops use 2 out of 3 (2003) trip logic. The trip logic reduces to 1 out of 2 (1002) logic when a loop transmitter fails or is bypassed. This creates a single point vulnerability (SPV) should a transmitter failure be undetected by the digital control system (DCS) while providing a false trip signal. This design was specifically included in the replacement of the TCS.

DESCRIPTION

A FCS trend of Rosemount transmitter failures recently caused engineering to reduce potential single point plant trip vulnerabilities by implementing a new modification for the TCS logic. The purpose of the modification was to eliminate the potential SPVs identified in multiple loops by changing the configuration of the signal selector block to provide 2 out of 2 (2oo2) trip logic when a transmitter is failed or bypassed and 2oo3 trip logic when all 3 inputs are available.

A work order (WO) implementing the EC was prepared and approved covering the configuration change and Post Modification Testing (PMT). The PMT was integrated into the work instructions, therefore no secondary PMT task was added to the electronic tracking, review and approval software. A Duty Manager Challenge, per WC-AA-2000 "Emergent Issue Response", was requested and performed by the Station Duty Manager for the activity. Engineering was performing a modification to the DCS to multiple turbine trip loops when the event occurred. Two loops involving lube oil pressure trip logic were successfully modified and tested under the WO just prior to the event.

An automatic turbine trip occurred resulting in an automatic Reactor Protective System (RPS) actuation due to loss of turbine load at 0841 Central Daylight Time (CDT) on June 22, 2016. The Headquarter Operations Officer (H00) was informed of the event per 10 CFR 50.72(b)(2)(iv)(B) (RPS Actuation) and 50.72(b)(3)(iv)(A) (Specified System Actuation (RPS)). This report is being submitted pursuant to 10 CFR 50.73(a)(2)(iv)(A), Specified System Actuation (RPS). The event was entered into the Corrective Action Program as CR 2016-05505. The trip occurred during Post Modification Testing activities on the turbine ETS pressure loop trip logic (third loop to be modified under the WO). There are two trip logic paths typically associated with the turbine trips: the first is the process level (e.g. low ETS pressure) with the second trip based on a deviation of 2 transmitters (2 in Deviation) from the median signal of the triplicated inputs processed by the signal selector block. Engineering failed to identify and disable the transmitter deviation based trip.

comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

I 05000-285 2016 - 003 Fort Calhoun Station - 00 The differences between the substituted input values selected for testing and the output of the signal selector block were sufficient to trigger the two transmitter deviation trip for the ETS loop.

CONCLUSIONS

Direct Cause(s):

1. Failure to identify the need to place block P3325_X2, Emergency Trip System Pressure 2-in- deviation input, in manual prior to PMT.

2. The values selected for the transmitter manual input during PMT placed the loop logic in a 2 in deviation condition which satisfied turbine trip logic through block P3325_X2.

The PMT for this modification was created by System Engineering following the completion of the Design Change Package (DCP). The DCP had installation instructions that identified placing the process trip block in manual but failed to recognize a second trip path existed. This information was not validated by the System Engineer while creating the work package and PMT.

Root Cause:

1. The Shift Management failed to set and to enforce standards related to the emergent work process.

The root cause was determined based on the organizational weakness that has been identified with the maintenance, implementation, and challenge of the emergent work process at FCS. It was identified that the overall standards associated with challenges to risk significant work within the station were below expectations.

Corrective Actions:

The basis for the corrective actions is to align the station on how to successfully implement the emergent work process at FCS. This includes the standards and expectations associated with the B-lists and risk determinations for items determined to be emergent. Direct and contributing causes were resolved through the use of setting expectations in the System Engineering department on technical products, station personnel training, and benchmarking fleet best practices.

FCS reviewed other work packages written or ghost written by System Engineering for same or similar errors, eliminated additional work on DCS components, and challenged the emergent work list to ensure bases and conditions were vetted with the correct amount of rigor to ensure similar events would not take place.

comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by e-mail to used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

Fort Calhoun Station 05000-285

3. LER NUMBER

2016 - 00 003

SAFETY CONSEQUENCES

PMT on DCS caused a turbine trip protecting the main generator as designed. Plant safety systems shutdown the reactor plant and support systems operated as designed. The plant trip is considered uncomplicated.

SAFETY SYSTEM FUNCTIONAL FAILURE

This does not represent a safety system functional failure in accordance with NEI 99-02, revision 7.

PREVIOUS EVENTS

process to prevent the plant trip.