Semantic search

On November 14, 2017, it was identified that the use of the Reactor Protection System (RPS) test fixture described in some operations procedures would result in the loss of two RPS reactor Scram functions. Technical Specification 3.3.1.1 requires that RPS Instrumentation for Table 3.3.1.1-1 Function 5, Main Steam Isolation Valve-Closure and Function 8, Turbine Stop Valve-Closure, remain operable. It was concluded that a closure of three of four Main Steam Lines or Turbine Stop Valves would not necessarily have resulted in a full Scram during testing depending on the combination of closed valves occurring during the bypass condition. Operations procedures were revised to incorporate the use of the test fixture in December, 2008 for the Turbine Stop Valve Closure Scram Test Procedure and February, 2009 for the Main Steam Isolation Valve Closure Scram Test Procedure. The operations procedures were inappropriately revised to allow use of the test fixture on all RPS functions to prevent a half Scram.

The operations procedures were quarantined until revisions were issued in December, 2017 that removed use of the test fixture.

On November 1, 2017, while in Mode 6 and at 0% power level, one of the C Loop Main Steam Safety Valves (MSSV) as-found lift pressure did not meet the acceptance criteria of +/- 3% of the setpoint (1129 psig) as required by Technical Specifications (TS) Surveillance Requirement (SR) 3.7.1.1. The MSSV lifted at 1171 psig which is 9 psig outside of its acceptance range of 1096 to 1162 psig and 3.72°o above its setpoint. The apparent cause of exceeding the MSSV upper acceptance limit is degradation of the valve spring and/or valve spindle compression screw. The as-found settings remained within analytical bounds; therefore, operation of the facility in this condition had no impact on the health and safety of the public.

TS Limiting Condition for Operation (LCO) 3.7.1, IvISSVs, requires five MSSVs per steam generator to be operable in Modes 1, 2, and 3. Since the failure affected the lift pressure over a period of time, it is assumed that the C Loop MSSV was inoperable for a time greater than allowed by TS. Therefore, this occurrence is considered reportable per 10 CFR 50.73(a)(2)(i)(B) as a condition prohibited by TS.

The C Loop MSSV was replaced on November 5, 2017, while in Mode 5.

During an investigation of a nitrogen leak inside the Unit 2 containment, Nitrogen Accumulator Relief Valve (RV) RV-355 was found to be leaking. The leak caused the pressure in the back up nitrogen accumulator supply to Power Operated Relief Valve (PORV) PCV-455C to decrease to a level that made the PORV inoperable. Based on a review of the ti-end data for nitrogen usage in the containment, it is conservatively assumed that RV-355 had been degraded since December 1, 2016, rendering the PORV inoperable for longer than permitted by Technical Specifications.

The presumptive cause was inadequate instructions provided in plant procedures for placing a new nitrogen bottle in service. These instructions did not provide a sequence that assures system pressure transients are mitigated. This may have caused excessive pressure excursions resulting in multiple lifts of RV-355 which resulted in damage to the RV 0-ring seat and a nitrogen leak path.

Corrective actions include replacing RV-355 and revising procedures to provide instructions on placing nitrogen supply bottles in service to maintain back pressure and minimize pressure transients on the nitrogen system.

This event did not affect the health and safety of the public.

On July 20, 2017, with the Davis-Besse Nuclear Power Station (DBNPS) operating at approximately 100 percent power, it was identified that the Emergency Diesel Generator (EDG) fuel oil storage tank vents were not adequately protected from potential tornado-generated missiles. If a missile crimped the vent it could disable the transfer pump or tank, potentially impacting the seven-day fuel supply for the affected train(s) of EDG. While the storage tanks were protected from tornado missiles when installed, the vents were not provided with any such protection. Compensatory measures were established to ensure a vent path remained following a tornado event, and actions will be taken to ensure the vents for each EDG fuel oil storage tank are adequately protected from tornado missiles.

This issue is being reported in accordance with 10 CFR 50.73(a)(2)(ii)(B) as an unanalyzed condition that significantly degraded plant safety, in accordance with 10 CFR 50.73(a)(2)(v) as a condition that could have prevented the fulfillment of the safety function, in accordance with 10 CFR 50.73(a)(2)(vii) as an event where a single cause or condition caused two independent trains to become inoperable in a single system, and in accordance with 10 CFR 50.73(a)(2)(i)(B) as a condition prohibited by Technical Specifications.

On June 15, 2017, at 1219 Eastern Daylight Time (EDT), Technical Specification (TS) Limiting Condition for Operation (LCO) 3.6.15 Condition B was entered for Watts Bar Nuclear Plant (WBN) Unit 1 annulus pressure not within limits, resulting in Shield Building inoperability. At 1221 EDT, the WBN Unit 1 annulus pressure returned to normal, the Shield Building was declared operable, and LCO 3.6.15 Condition B was exited. Because the shield building is a non-redundant safety system, operation outside of TS allowable limits represents an event that could have prevented fulfillment of a safety function.

The temporary loss of the Shield Building resulted from a loss of pressure control in the Auxiliary Building caused by a loss of Auxiliary Building General Ventilation due to a spurious cross zone fire alarm. The Auxiliary Building Gas Treatment System was started to maintain Auxiliary Building pressure within limits and the non-safety related Annulus Auxiliary Building ventilation supply fans were replaced.

On June 9, 2017. Watts Bar Nuclear Plant (WBN) personnel determined that the reporting requirements of 10 CFR 50.72(b)(3)(v) and 10 CFR 50.73(a)(2)(v), as clarified by guidance in NUREG-1022, Revision 3. were being incorrectly applied for certain events associated with single train safety systems. When events occurred that resulted in these systems not meeting Technical Specification (TS) Limiting Conditions for Operation (LCO). the short duration of these events relative to their required action completion time, coupled with prompt return to allowable values, were not considered a loss of safety function by Operations and Licensing personnel. As a result, multiple potential loss of safety function events were not reported as required. These events were related to Refueling Water Storage Tank (RVVST) level, Containment and Shield Building pressure, and Control Room Envelope integrity.

A review of these events indicate, when considering the actual system capability and the response of equipment and personnel. a loss of safety function capability impacting public health and safety did not occur for events associated with the RWST, Containment. Shield Building, or Control Room. Corrective actions include briefing personnel on the regulatory impact of these events, and the importance of the control room boundary.

.._ _ NRr, FORM Kri 2017:

On May 14, 2017, at 0233 hrs, Indian Point Unit 3 entered Mode 4 as part of coming out of outage 3R19 and preparing for power operations. Operations test group was preparing for performance of 3-PT- CS004, Residual Heat Removal (RHR) Check Valve Testing. The team gathered for a pre job brief in accordance with the requirements of EN-HU-102, Human Performance Traps &Tools Procedure. At the time the only allowable access point to the Inner Crane Wall was through the double gate combination of Gates D and E, which require one gate to be maintained closed and secured at all times. Workers needed to enter inside of the Crane Wall to perform a portion of the valve lineup required by 3-PT-CS004. After unbolting and opening the gate, the two operators and a contract Radiation Protection (RP) Technician went through gate C despite a posted sign stating that the gate was not to be utilized in modes 1 through 4.

While the valve manipulations were in progress the NRC Resident Inspector was also conducting a tour of the Vapor Containment (VC) and identified that gate C was opened. This gate being open in this plant condition resulted in a safety system functional failure, since with the gate unsecured this made the containment sumps inoperable.

On June 16, 2017, during implementation of a modification to Keowee Hydroelectric Station Governor Actuator Cabinets 1 and 2, breakers were inadvertently repositioned in each of the governor control system for Keowee Hydroelectric Units 1 and 2 (KHU1 and KHU2), rendering both units inoperable. The condition was discovered following an unsuccessful start of KHU2 for commercial operation. The KHUs are the onsite emergency power source for the Oconee Nuclear Station.

It was concluded that this constituted a loss of safety function from the time when both KHUs were inoperable until the dedicated offsite power source was aligned to the emergency busses; a period of approximately 7 hours. This condition is reportable pursuant to 10 CFR 50.73(a)(2)(v)(A-D).

Technical Specifications (TS) were followed based on time of discovery; however, a subsequent review of computer logs provided firm evidence that both KHUs were inoperable for longer than allowed by TSs based on "past inoperability," requiring this event to be reported pursuant to 10 CFR 50.73(a)(2)(i)(B) as a condition prohibited by the plant's Technical Specifications.

The direct cause of this event was attributed to the reposition due to inadvertent contact of two 24 VDC breakers. The risk impact of this event was determined to be insignificant and corrective actions are planned to prevent recurrence.

NFtC FORM 386A (04-2017) U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY OMB: NO. 3150-0104 EXPIRES 3/3112020 (See form 366 above for burden estimate) I NUMBER NO.

2017 - 001 - 00 Oconee Nuclear Station Unit 1 5000269 am

• .1.11;InsW

• Imb .....

• 110-Milar

BACKGROUND

At Oconee Nuclear Station (ONS), the Keowee Hydroelectric Station (KHS) (EIIS:EK) serves the emergency power function typically performed by diesel generators (EIIS: DG) at other nuclear facilities.

The KHS consists of two (2) hydroelectric turbine/generator units (KHUs) and associated support equipment and auxiliaries. Each KHU is provided with its own automatic start equipment and both KHUs undergo simultaneous automatic emergency starts during an emergency. Either KHU may be aligned to either of two emergency power paths, with the underground path being preferred if only one KHU is available. In addition to Keowee, a 100 kV transmission line from a nearby plant with dedicated combustion turbines (EllS: TUR) can provide power to the Stand-by Buss (the emergency buss that supplies emergency loads on all three Oconee units).

Governor (EIIS: 65) Actuator Cabinets (EIIS: CAB) GAC1 and GAC2 contain control circuitry and components for KHU1 and KHU2 respectively, including breakers (EIIS: 52) K1 GCS BK0001 and K2 GCS BK0001 as part of the Governor Control System for KHU1 and KHU2 respectively. These breakers are small, 'plug in' type, 10 amp breakers with the actuating power switches (EIIS: JS) protruding into an open space inside their respective cabinets. These breakers provide 24 VDC to a distributing valve (EIIS: V) assembly and shutdown solenoid valve (EIIS: SV) which are both required to actuate for Keowee to start. The shutdown solenoid is a fail-safe valve that requires energization to open during turbine operation. Without power, the solenoid valve closes.

EVENT DESCRIPTION

On June 16, 2017, at approximately 0740 hours, workers were implementing a modification to Governor Actuator Cabinets 1 and 2 located within the Keowee Hydroelectric Station. The investigation showed that at approximately 0907 hours, Operator Aid Computer (OAC) alarm (EllS: ALM) indications for K1 GCS BK0001 breaker for KHU1 Channel A and B Governor Critical Alarm were received on the OAC alarm screens located in the Keowee Control Room (KCR). These alarms were not observed by the Keowee operator since he was still on rounds and not in the KCR. Normally, when a Governor Critical Alarm is received, Stat-Alarms in both the Keowee and Oconee Unit 2 Control Rooms are generated. Additionally, a governor critical alarm condition triggers an emergency lock-out of the unit, which would also normally generate Stat-Alarms. However, in this-instance, no Stat-Alarms were generated and no emergency lock-out condition was triggered due to the failure mode design of the repositioned breaker defeating the signal sent to the Stat-Alarms. Had a Stat-Alarm been received, the protocol of Stat-Alarm management would have been followed by the Oconee Unit 2 Control Room, the Oconee Unit 2 Senior Reactor Operator and the Keowee Control operators, potentially reducing the probability for this single incident to have escalated further. At 1020 hours, similar OAC alarm indications were received in the KCR associated with the KHU2 K2 GCS BK0001 breaker.

• At 1321 hours, while attempting to start KHU2 for commercial generation, an "incomplete start" alarm was received in the KCR. Investigation into the matter subsequently revealed that the two (2) repositioned breakers were open and both KHUs were non-functional. Each KHU was declared inoperable at 1635 hours.

In Mode 1, KHU operability is required by TS 3.8.1, "AC Sources - Operating," and TS 3.7.10, "Protected Service Water." The appropriate TS conditions were entered and the Required Actions completed within the allowed Completion Times. As required by TS Limiting Condition for Operation (LCO) 3.8.1, Condition I, due to the loss of both KHUs, Standby Buses were energized from a 1 dedicated Lee Combustion Turbine and an isolated power path at 1715 hours. An NRC Emergency Notification System (ENS) call was made at 0032 hours on June 17, 2017, pursuant to 10 CFR 50.72(b)(3)(v)(A-D), reporting the event as a loss of safety function (Ref.: EN 52812). The reporting premise for the loss of safety function was that there was a 40 minute period, between when both KHUs were declared inoperable and when the LCTs energized the standby busses, when the station was without its normal onsite emergency power sources.

Subsequent troubleshooting efforts concluded that the two KHU1 and 2 breakers were mechanically and electronically sound and operating properly, but due to work activities being performed in the vicinity of these breakers, had probably been inadvertently repositioned. Both breakers were returned to the closed position and a KHU1 functional run was conducted. KHU1 was declared operable at 2150 hours. A KHU2 functional test run was then performed, the unit declared operable at 2351 hours, and the associated TS Conditions related to this event were exited.

Based on a review of OAC data, it was subsequently determined that a loss of safety function existed between 1020 hours (the time when both KHUs were rendered inoperable due to the inadvertent breaker repositioning) and 1715 hours (when the offsite Lee Combustion Turbines were aligned to the standby busses); a period of —7 hours. A loss of safety function is reportable pursuant to 10 CFR 50.73(a)(2)(v)(A-D) as "Any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are need to: (A) Shut down the reactor and maintain it in a safe shutdown condition; (B) Remove residual heat; (C) Control the release of radioactive material; or (D) Mitigate the consequences of an accident.

From the time KHU inoperability was initially declared at 1635 hours on June 16, 2017, TS LCOs 3.8.1 and 3.7.10 were appropriately entered and the Required Actions completed within the stated Completion Times. However, a review of OAC data revealed that the first KHU was actually inoperable on June 16, 2017, beginning at 0907 hours and as such, the 1-hour TS LCO 3.8.1 Required Action Completion Time (per Required Action C.1) was not satisfied. Consequently, this event is also reportable pursuant to 10 CFR 50.73(a)(2)(i)(B) as a condition prohibited by the plant's Technical Specifications.

CAUSAL FACTORS

The direct cause of this event is attributed to the two (2) 24 VDC breakers K1 GCS BK0001 and K2 GCS BK0001, being out of position and rendering both KHUs inoperable due to human error.

CORRECTIVE ACTIONS

1. Completed Verified governor control system integrity on both units which allowed restoration of KHU operability in accordance with TS LCO 3.8.1.

2. Planned a. Enhance Governor Control System (GCS) lesson plans to address this event.

b. Enhance protective measures (e.g., physical / passive / extra signage) requirements for the GCS panels as well as other KHU repositionable components that may be susceptible to a similar event.

c. Improve Work Management controls to address (1) the potential consequences of working on both KHUs at the same time and (2) limiting work on a KHU that is in service.

The planned corrective actions indicated above are NOT considered NRC Commitment items.

SAFETY ANALYSIS

A probabilistic risk assessment (PRA) evaluation was conducted for the period of KHU inoperability to determine the significance of this event. It was determined through a quantitative analysis that the event had a negligible effect on the delta Core Damage Frequency (CDF) and delta Large Early Release Fraction (LERF), resulting in an insignificant impact on the health and safety of the public. This was largely due to the sustained availability of the Lee Combustion Turbine and the Standby Shutdown Facility as well as the Protected Service Water system in a.Loss of Offsite Power situation. These additional options for preventing core damage further reduce the impact of the event on CDF and LERF.

Another major driver in the negligible risk impact was the historical lack of any threat of severe weather over the duration of the KHU unavailability. When KHU failures show up in the risk model as being significant, it is almost exclusively paired with an occurrence of a Loss of Offsite Power due to severe weather. When severe weather is not expected and does not occur, the importance of the KHUs in the risk model drops significantly. Finally, the short time frame the condition existed results in an insignificant risk impact.

ADDITIONAL INFORMATION

Similar Events:

For the preceding three (3) year period, ONS has submitted three (3) LERs which reported under either 10 CFR 50.73(a)(2)(v)(A-D) or 10 CFR 50.73(a)(2)(i)(B) criteria (but not both).

startup transformer which created a temporary loss of the power paths required by TS 3.8.1 and was reported under 10 CFR 50.73(a)(2)(v)(A-D) as a condition that could have prevented.the fulfillment of a safety function.

2. LER 287/2016-001 Revision 0: Described the discovery of a Unit 3 inoperable reactor building cooling unit in which had existed longer than the time allowed by the Technical Specifications and reported per 10 CFR 50.73(a)(2)(i)(B). It was also revealed that Unit 3 had entered the mode of applicability which with the inoperable cooling unit which is prohibited by TS 3.0.4.

3. LER 269-2016-002 Revision 0: Described the discovery of inoperable containment high range radiation monitors due to the potential effects of thermally induced currents during a HELB event in a containment penetration room. It was concluded that the inoperable condition had existed longer than the time allow by the Technical Specification and was reported under 10 CFR 50.73(a)(2)(i)(B).

A review of the aforementioned LERs did not point toward a similar cause or corrective actions that could have prevented this event.

Energy Industry Identification System (EIIS) codes are identified in the text as (XX).

This event is considered INPO Consolidated Events System (ICES) Reportable rather than EPIX reportable (refer to LER line 13 on page 1). There were no releases of radioactive materials, radiation exposures in excess of limits or personnel injuries associated with this event.

In February and March 2017, three Main Steam Safety Relief Valve (SRV) body assemblies (main body and pilot assembly) and the remaining five SRV pilot assemblies were tested at National Technical Systems Laboratories (formerly Wyle Laboratories). These SRVs had been removed from Cooper Nuclear Station during Refueling Outage 29 in the Fall of 2016. One SRV pilot assembly failed the as-found lift pressure testing; another SRV pilot assembly was conservatively considered a failure due to lack of as-found lift pressure test data since it was inadvertently disassembled prior to performing the as-found lift pressure test.

There were two causes for the failures. One of the SRV pilot assemblies failed due to corrosion bonding; the other SRV pilot assembly failed due to a lack of a barrier to prevent inadvertent disassembly of the SRV pilot prior to testing.

Although the Technical Specifications limits related to the set point lift pressures of the SRV pilot valve assemblies were exceeded, an analysis indicates that the design basis pressures to ensure safety of the reactor vessel and its pressure related appurtenances were not challenged. Public safety was not at risk. Safety to plant personnel and plant equipment was not at risk.

On November 21, 2016, as a result of investigating an increased level rise in the Waste Hold-Up. Tank (WHUT), Operators identified a corresponding rise in containment sump level. A containment entry was made to investigate the source of the sump level rise and determined the source was a through wall leak in a Service Water (SW) supply pipe elbow to the 24 Fan Cooler Unit (FCU). The leak constituted a breach of a closed system within containment. Technical Specification (TS) 3.6.1 (Containment) was entered and containment declared inoperable. TS 3.6.6 (Containment Spray and Fan Cooler System) was entered when the 24 FCU was secured and SW to the 24 FCU was isolated. Inspections identified a through wall leak on .a SW supply pipe elbow to one of the 24 FCU water boxes.

The leak is on a 3 inch carbon steel epoxy-lined elbow.

The pipe fitting is in an ASME ISI Code Class 3, nuclear safety related piping system.

The direct cause was failure of the interior coating allowing brackish river water to corrode the carbon steel fitting. The root cause was the maintenance coating procedure requirements for post-coating inspections were inadequate. Key corrective actions included removal of the defective elbow and weld repair, recoating and re-installation.

Maintenance procedure 0-SYS-409-GEN will be revised to mandate detailed inspections and/or testing of surface preparation and applied coatings to ensure proper coverage and adhesion. The event had no effect on public health and safety.

NO:

Indian Point 2 05000-247

At 1514 EST on January 6, 2016, while operating at 100 percent Reactor Thermal Power (RTP), the East and West Turbine Bypass Valves (TBV) automatically opened as expected for 3 minutes and 32 seconds in response to the number one High Pressure Turbine Stop Valve (TSV) drifting from full open to 25 percent open due to an actuator malfunction.

Per Technical Specification (TS) Bases 3.3.1.1, TBVs must remain shut while RTP is at or above 29.5 percent to consider all channels of the TSV closure and Turbine Control Valve (TCV) fast closure Reactor Protection System (RPS) functions operable.

Reactor Operators lowered RTP to 91.0 percent and at 1518 EST the TBV automatically closed and the TSV closure and TCV fast closure RPS functions were no longer considered inoperable. TS 3.3.1.1 requires that the TSV closure and TCV fast closure RPS functions be operable at or above 29.5 percent RTP. In this event, during the period of time while TBVs were open, reactor power was maintained above 91 percent and the RPS functions were confirmed to be enabled.

The actuator malfunction was caused by faulty connectors within the actuator. The faulty connectors were replaced.

On September 7, 2016, at 2131, with Unit 1 in Mode 1 and 100 percent power, the reactor was manually tnpped and reactor coolant pumps were secured due to a control malfunction which prevented closure of a pressurizer spray valve. This event initiated from an unsuccessful attempt to transfer a non-class 120VAC instrument power bus from its normal source to its emergency/alternate source. The transfer was attempted to facilitate an inspection of an electrical load center which was sprayed with water earlier in the day by a leaking sprinkler head following Fire Protection (FP) Department routine testing of a FP water line.

The cause of the spray valve malfunction was a failed pneumatic volume booster in the spray valve actuator system combined with a current to pressure converter (I/P) calibration offset which resulted from a voltage transient during the unsuccessful electrical transfer. These conditions caused the spray valve to stay approximately five percent open when it received a close demand from the spray valve controller. The I/P converter and pneumatic volume booster were replaced and the spray valve was returned to service. Additional corrective actions will adjust preventive maintenance frequency on the pneumatic volume boosters.

In the past three years, PVNGS has not reported a similar event to the NRC.

On July 8,2015, during surveillance testing, the Control Room received a 6.9kV motor trip alarm due to 31 Condensate Pump (CP) Motor circuit breaker trip on overcurrent. .

Operators entered Alarm Operating Procedure 3-A0P-FW-1 due to loss of the 31 CP and initiated a load reduction. During this time the Main Boiler Feedwater Pump (MBFP) suction pressure decreased to its suction pressure cutback controller pressure range and its output decreased MBFP speed control to a minimum. The 31 MBFP speed control signal locked in at this minimum speed signal due to actuation of the MBFP Lovejoy speed control system Track and Hold feature. Due to this minimum 31 MBFP condition, the 31 MBFP , recirculation valve opened causing the 31 MBFP check valve to close. With the 31 MBFP unloaded, Steam Generator (SG) water levels decreased and at 15 percent operators manually tripped the reactor. The Auxiliary Feedwater System automatically started as expected due to SG low level from shrink effect. Direct cause was the 31 MBFP entered a Hold condition erroneously due to a miss-wired Track and Hold board in the speed control system. The root cause was the procurement for the MBFP Lovejoy Track and Hold boards was at an insufficient quality level commensurate with its criticality. There was a failure to mandate functional testing and wiring verification requirements on the vendor to ensure the procurement of a quality product. Corrective actions included replacement of MBFP track and hold board and 31 CP motor. A new replacement Track and Hold circuit board for both the 31 and 32 MBFP speed control system with the miss-wiring corrected was installed. The quality levels for the Track and Hold boards were revised from Q4 to Q3.

MBFP Lovejoy speed control maintenance procedures and site vendor manuals were revised to include more detail. The event had no effect on public health and safety.

FACILITY NAME (1) DOCKET (2) LER NUMBER (6) PAGE (3)

On August 9, 2016, Technical Specification (TS) Limiting Condition for Operation (LCO) 3.7.2, Condition A was entered for Unit 2 main steam isolation valve SGE-UV-171 (MSIV 171) train A actuator to perform a nitrogen pre-charge check.

The check identified low nitrogen pre-charge pressure on the train A accumulator. An engineering evaluation determined that the MSIV 171 train A actuator was inoperable since July 30, 2016 due to a nitrogen leak on the accumulator. This inoperability period exceeded the 7-day required action completion time for one MSIV actuator train. The MSIV 171 train A actuator was restored to operable status and LCO 3.7.2, Condition A was exited on August 9, 2016. The accumulator leak was repaired on October 5, 2016. Insufficient monitoring, trending, and understanding of reservoir hydraulic fluid level trends in relation to the nitrogen pre-charge required for MSIV operability led to the extended inoperability period.

Operator training will be revised to improve understanding of the system and the limitations of the hydraulic fluid level alarm. Additional corrective actions will revise procedures to provide enhanced rigor for the control of operations condition monitoring thresholds for an MSIV to ensure appropriate response times. Maintenance procedures will also be revised to provide more explicit guidance to minimize the potential for leaks. In the past 3 years, PVNGS has not reported a similar event to the NRC.

On July 6, 2016,Instrument and Control (I&C) technicians were preparing to perform 2-PT-2M3A (RPS Logic Train B Actuation Logic Test and Tadot). Prior to starting the test, the I&C technicians were unable to locate key #184 that was identified in the test as associated with the reactor trip breaker B bypass key switch. Control Room staff recommended obtaining key #183 associated with reactor trip breaker A bypass key switch to use in lieu of key #184. To ensure the key would work prior to starting the test, the train B bypass key switch was positioned by an I&C technician to the Defeat position. Because reactor trip Bypass Breaker B was in the racked out position, when the key switch was taken to the Defeat position, it caused the normal Reactor Trip Breaker B to open, which initiated a reactor trip (RT) and auxiliary feedwater system actuation. The direct cause was an I&C technician turned the key interlock to defeat on switchgear Channel B Reactor Protection Logic without having the BYB Bypass breaker racked in and closed. The root cause was Indian Point personnel emphasized work culture production goals without fully recognizing the need to maintain fundamental standards and expectations for nuclear workers. Key corrective actions included site all-hands meeting discussing the event, lessons learned, reinforced expectations and the Fleet Refocus Initiative. As an interim action, all essential work that effects generation was required to have direct oversight by a superintendent or above, all work start authorizations provided by operations undergo a work challenge utilizing a new checklist from this event. Complete the actions associated with the Fleet Refocus Observation program. The event had no effect on public health and safety.

Indian Point 2 05000-2'47 APPROVED BY OMB: NO. 3150-0104 EXPIRES: 10/31/2018 comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by Internet e-mail to Note: The Energy Industry Identification System Codes are identified within the brackets (1.

DESCRIPTION OF EVENT

On July 6, 2016,while at 100 percent reactor power, preparations were in progress to commence a scheduled bi-monthly surveillance test in accordance with 2-PT-2M3A (RPS Logic Train B Actuation Logic Test and TADOT (>25% Reactor Power)). The purpose of the surveillance is to perform actuation logic testing of the Reactor Protection System (JC) logic Train B in accordance with Technical Specification (TS) 3.3.1 (Reactor Protection System Instrumentation) Table 3.3.1-1, Function 20, Surveillance Requirement 3.3.1.5. The test had been originally scheduled for June 30, 2016, but due to concerns about Battery Changer 22 grounds, the test was re-scheduled for the following week., At approximately 07:30 hours, on July 6, 2016, a pre-job briefing was held with four I&C technicians and the I&C job Supervisor. Subsequent to the briefing, the I&C technicians went to the Control Room (NA) and informed the Control Room Supervisor (CRS) of the test and what to expect. In the prerequisites section of 2-PT-2M3A, the breaker interlock key number 182, 184 or equivalent was to be obtained from operations prior to commencing the test. At approximately 9:15 hours, I&C personnel determined neither key number 182 nor key number 184 could be found in the Control Room key locker. The CRS suggested that the Train A key number 183 could be used as an equivalent because it was believed that both trains were keyed the same.

Due to concerns with the short Technical Specification (TS) 8-hour Allowed Outage Time (AOT) for the test the I&C technicians wanted to ensure the key would work prior to entering the TS Limiting Condition for Operation (LCO) and starting the test and discussed it with the CRS. The key concerns were discussed with the CRS. After a brief discussion, the I&C technicians believed that Operations gave them permission to test the key prior to starting the surveillance test. Operations believed that the I&C technicians would test the key during the surveillance.

At approximately 9:30 hours, two of the I&C technicians, one operator and two Nuclear Plant Operator (NPOs) took key number 183 (designated for Train A) to the location of the Reactor Trip Breakers (RTBs) (BKR)(Cable Spreading Room) (NA). The 8-hour TS LCO was not entered. Two non-licensed operators (NPOs) were present in the Cable Spreading Room to rack in the bypass breaker when requested by the I&C technicians.

The Field Shift Supervisor (FSS) was also there to inspect cables that were utilized with the Rod Drop Testing during the recent outage. One of the I&C technicians called the Control Room and told another I&C technician, who was staged in the Control Room, that they would receive an annunciator on Panel SK, Window 2-5. The Control Room operator acknowledged the alert of an expected alarm and the I&C technician in the Control Room relayed the acknowledgement to the I&C technician in the Cable Spreading Room containing the RTBs.

comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by intemet e-mail to An I&C technician signaled the other I&C technician that was at the RTBs to test the key. Without using a procedure or an approved work instruction, the other I&C technician positioned the Train B bypass key switch to defeat.. Because reactor trip Bypass Breaker B was in the racked out position, when the train B bypass key switch was taken to the Defeat position, it caused the normal Reactor Trip Breaker B to open, which initiated a reactor trip (RT) at approximately 9:38 hours.

All control rods (AA) fully inserted and all required safety systems functioned properly. The plant was stabilized in hot standby with decay heat being removed by the condenser (SG). The auxiliary feedwater system (BA) actuated as expected due to steam generator low level from shrink effect.

Normally during performance of the test, the train B bypass key switch is only positioned to Defeat after Bypass Breaker B has been closed and the Reactor Trip Breaker B- has been opened. The condition was recorded in the Indian Point Energy Center (IPEC) Corrective Action Program (CAP) in. Condition Report CR-IP2-2016-04320.

The reactor protection system (RPS) (JC) initiates a reactor shutdown, based on values of selected unit parameters, to protect against violating the core fuel design limits and reactor coolant system pressure boundary during anticipated operational occurrences and to assist the Engineered Safety Feature Systems in mitigating accidents. The RPS instrumentation is segmented into four distinct but interconnected modules one of which is reactor trip switchgear that includes the reactor trip breakers (RTBs) and Bypass Breakers. These components provide a means to interrupt power to the control rod drive mechanisms (CRDMs) and allows the rod cluster control assemblies (RCCAs) or rods to fall into the core and shut down the reactor. The bypass breakers allow testing of the RTBs at power. The control rod drive system is designed such that the control rods are held in place and are capable of being moved only when its power supply is energized. Two RTBs placed in series with the control rod drive power supply remain closed as long as their respective under-voltage coils are kept energized by the RPS logic buses. Two bypass breakers are provided to allow in service testing of either RTB. The key-interlock switch is provided such that if both bypass breakers are closed at the same time while racked in, both bypass breakers will be tripped. This interlock is defeated in the test position with the key to allow for tripping of the undervoltage device of the bypass breaker when the reactor is in operation. The key interlock switch at the Reactor Trip Switchgear is placed in the Defeat position to prevent repeated breaker operation as the logics are tripped and reset.

During normal testing of the RPS Logic, the bypass breaker is racked in and closed and the key-interlock switch would then only bring in the alarm in the Control Room supervisory annunciator. For this event the bypass breaker was not racked in (closed).

comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by Internet e-mail to The bypass breakers must be manually closed and under no circumstances should both bypass breakers be racked in and closed at the same time. During normal testing of Channel B, the associated key-interlock switch would have been placed in the defeat position. This would have resulted in: 1) Illuminating a red light on the Train B cabinet, 2) Annunciating an alarm RTB & BYA Train B Defeat on the Control Room supervisory annunciator, 3) Opened up the closing circuit of RTB which is being tested, 4) Opened up the coil circuit of undervoltage trip devices for breakers RTB and BYA which is being tested and preventing the unit from tripping. In this event the key bypass switch was turned to the defeat position while the Bypass Breaker was still racked out (open) which de-energized the undervoltage coil for the B RTB which caused it to open and trip the unit.

An extent of condition (EOC) review determined the condition is bounded to only the RTBs because they are the only breakers with a key-interlocked switch such that if both bypass breakers are closed at the same time while racked in, both bypass breakers will be tripped. The test procedure for unit 2 calls for key number 182, 184 or allows for an equivalent key to be used. This is vague guidance unlike unit 3 which only has one key. The Unit 2 test procedure 2-PT-2M3A will be revised to remove "equivalent.

CAUSE OF EVENT

The direct cause of the RT was due to operating the "B" RPS bypass key out of sequence during Reactor Protection logic testing. An I&C technician turned the key interlock to defeat on switchgear Channel B Reactor Protection Logic without having the BYB Bypass Breaker racked in and closed, which opened the undervoltage tripping device of the RTB and tripped the reactor. The I&C technician turned the key without procedural guidance. The I&C technicians were testing the key with verbal guidance from operations, due to vague procedure guidance in 2-PT-2M3A, that allowed an equivalent key to be used (number 183). Due to not stopping when unsure (conservative decision making), the I&C technicians tested the key prior to starting the surveillance because of perceived time pressure.

The root cause (RC) of the event was that IPEC personnel emphasized work culture production goals for productivity, schedule adherence, and backlog reduction without fully recognizing the need to maintain fundamental standards and expectations for nuclear workers, such as procedure use and adherence and staying in process during work activities. The RC resulted in the I&C technician turning the key without procedure guidance or work instructions and tripped the plant.

CORRECTIVE ACTIONS

The following corrective actions have been or Action Program (CAP) to address the causes of

• Site all-hands meeting was held to discuss to reinforce expectations.

will be performed under the Corrective this event:

the event, the lessons learned, and comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by intemet e-mail to

• discuss the Fleet Refocus Initiative.

• work that effects generation was to have direct oversight by a superintendent or above.

• All work start authorizations provided by operations watch personnel must now undergo an additional work challenge utilizing a checklist developed in response to this event. Revised process was formalized by an Operations Standing Order.

• The completion of corrective actions associated with the Fleet Refocus Observation Program will be documented to ensure all personnel apply the essential knowledge, skills, behaviors and practices needed to conduct work safely and reliably.

• Procedures 2-PT-2M3, 2-PT-2M2, and 2-PT-2M2A will be revised to remove the word "equivalent" to prevent any questions on which key to use.

EVENT ANALYSIS

The event is reportable under 10CFR50.73(a)(2)(iv)(A). The licensee shall report any event or condition that resulted in manual or automatic actuation of any of the systems listed under 10CFR50.73(a)(2)(iv)(B). Systems to which the requirements of 10CFR50.73(a)(2)(iv)(A) apply for this event include the Reactor Protection System including reactor trip and AFWS actuation. This event meets the reporting criteria because an automatic reactor trip was initiated at 9:38 hours, on July 6, 2016, and the AFWS actuated as a result of the RT. On July 6, 2016, at 13:16 hours, a four hour non-emergency notification was made to the NRC (Log Number 52067) for an automatic reactor trip while critical and included the eight hour non-emergency notification for the actuation of the AFW system. Both notifications were in accordance with 10CFR50.72(b)(3)(iv)(1). The event was recorded in the Indian Point Energy Center corrective action program (CAP) as CR-IP2-2016-04320.

As all primary safety systems functioned properly there was no safety system functional failure reportable under 10CFR50.73(a)(2)(v).

PAST SIMILAR EVENTS

A review was performed of the past three years of Licensee Event Reports (LERs) for events that involved a reactor trip due to testing of the reactor protection system.

No applicable LERs were identified.

SAFETY SIGNIFICANCE

This event had no effect on the health and safety of the public.

This condition had no effect on the health and safety of the public.

There were no actual safety consequences for the event because the event was an uncomplicated reactor trip with no other transients or accidents.

• Small Group Meetings.

• from the Fleet Refocus Initiative.

Site All-hands meeting was held to Conducted Fleet Refocus Initiative Implemented observation activities As an interim action all essential comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by intemet e-mail to Required primary safety systems performed as designed when the RT was initiated. The AFWS actuation was an expected reaction as a result of low SG water level due to SG void fraction (shrink), which occurs after a RT and main steam back pressure as a result of the rapid reduction of steam flow due to turbine control valve closure.

For this RT there was no actual condition to initiate the reactor trip breaker opening. Event was initiated by human error.

There were no significant potential safety consequences of this event. The RPS is designed to actuate .a RT for any anticipated combination of plant conditions to include low SG level. All components in the RCS were designed to withstand the effects of cyclic loads due to reactor system temperature and pressure changes. The reactor trip breakers (RTBs) are in the electrical power supply line from the control rod drive motor generator set power supply to the CRDMs. Opening of the RTBs interrupts power to the CRDMs, which allows the shutdown rods to fall into the core by gravity. Each reactor trip breaker (RTB) is equipped with a reactor trip bypass breaker (RTBB) to allow testing of the trip breaker while the unit is at power. Each RTB and RTBB is equipped with an undervoltage coil and a shunt trip coil to trip the breaker open when needed. The reactor trip signals generated by the RPS automatic trip logic cause the RTBs and associated RTBB to open and shut down the reactor.

There are two RTBs in series so that opening either will interrupt power to the rod control system and allow the control rods to fall into the core and shut down the reactor. Each RTB has a parallel RTBB that is normally open. This feature allows testing of the RTBs at power. A trip signal from RPS logic train A will trip RTB A and RTBB B; and a trip signal from logic train B will trip RTB B and RTBB A. During normal operation, both RTBs are closed and both RTBBs are open. When any one train is taken out of service for testing, the other train is capable of providing unit monitoring and protection until the testing has been completed.

For this event, rod control was in automatic and all rods inserted upon initiation of a RT. The AFWS actuated and provided required FW flow to-the SGs. RCS pressure remained below the set point for pressurizer PORV or code safety valve operation and above the set point for automatic safety injection actuation. Following the RT, the plant was stabilized in hot standby.

Indian Point 2 05000-247

On April 27, 2016, with Millstone Power Station Unit 2 (MPS2) in MODE 1 at 100% power, plant personnel inadvertently left the door to the turbine driven auxiliary feed purnp room open. This condition existed for less than one hour.. The door is a high energy line break (HELB) barrier. With the door open there is no HELB protection for the motor driven auxiliary feedwater (AFW) pumps thus potentially rendering both trains of AFW inoperable.

The cause is human performance error. The door is conspicuously labeled on each side that it is a HELB boundary door and must be closed except for entry and exit from the room. Corrective actions are being taken in accordance with the station's corrective action program.

This condition is being reported pursuant to 10 CFR 50.73(a)(2)(v) as any event or condition that alone could have prevented the fulfillment of the safety function of structures or systems that are needed to: (B) remove residual heat; and (D) mitigate the consequences of an accident.

On June 20, 2016, Entergy management was advised by the NRC that during a tour in containment while the unit was in Mode 4, the inspector identified two open barrier gates for the Emergency Core Cooling System (ECCS) sump.

Personnel were moving scaffolding from inside the crane wall to areas outside the crane wall through the two open barrier gates. Having both sump barrier gates open violated ECCS operability basis which requires the sump barrier system to be operable in Modes 1-4.

The inspector notified the operator touring with him of the observation. The operator subsequently coached the Radiation Protection (RP) door guard to ensure that one of the gates be closed at all times. The apparent cause was a latent organizational weakness associated with the use of procedure OAP-007 (Containment Entry and Egress) which had not been communicated well within the organization.

The failure mode was personnel not being aware of all available information.

The scaffold supervisor was not aware of his requirement to serve as containment coordinator and provide the required briefing on gate closure. The RP brief was focused on the locked high radiation requirements not gate control. Corrective actions included closing and securing one gate, briefing RP personnel on the event, the lessons learned and management expectations. This event will be included in all 3R19 supplemental supervisors qualifications required reading list. Procedure OAP- 007 will be revised to include a checklist for entry briefings to include GS-191 requirements. The event had no significant effect on public health and safety.

Indian Point 2 05000-247 APPROVED BY OMB: NO. 3150-0104 EXPIRES: 10/31/2018 comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by intemet e-mail to Note: The Energy Industry Identification System Codes are identified within the brackets ().

DESCRIPTION OF EVENT

On June 20, 2016, Indian Point management was advised by the NRC that during a tour in containment (NH) while the unit was in Mode 4, the inspector identified two open barrier gates for the Emergency Core Cooling System (ECCS) (BQ) sump. Personnel were removing disassembled scaffolding from inside the crane wall on the 46 foot elevation of containment and moving it through the ECCS sump barrier gates (GATE) to areas outside the crane wall through the two open barrier gates. Having both sump barrier gates open violated ECCS operability basis which requires the sump barrier system to be operable in Modes 1-4. The plant had entered Mode 4 on July 10, 2016, at 23:30 hours. The inspector notified the operator touring with him of the observation. The operator subsequently coached the Radiation Protection (RP) door guard to ensure that one of the gates were closed at all times. No condition report recorded the event at the time. Subsequently, on June 20, 2016, after an NRC inspector advised a site manager the condition was recorded in the Indian Point Energy Center (IPEC) Corrective Action Program (CAP) as Condition Report CR-IP2- 2016-04036. On June 21, 2016, CR-IP2-2016-04037 recorded the failure to initiate a CR at the time of the event.

For postulated breaks in the Reactor Coolant System (RCS) (AB) there are two recirculation related sumps within the containment, 1) the Recirculation Sump and, 2) the Containment Sump. Both sumps collect liquids discharged into the containment during a design basis accident. As part of the resolution of Generic Safety Issue (GSI)-191 (Assessment of Debris Accumulation on PWR Sump Performance) and Generic Letter 2004-02 (Potential Impact of Debris Blockage on Emergency Recirculation During Design Basis Accidents at Pressurized Water Reactors) various flow barrier debris interceptors were installed in the containment to channel the recirculation flow into the reactor cavity sump area, up and out of the Incore Instrumentation Tunnel, through the crane wall and containment sump labyrinth wall via specially designed openings, and into the annulus area outside the crane wall.

The recirculation flow will migrate towards the Recirculation Sump or the Containment Sump depending on which pump(s) are operating. Flow channeling barriers are installed on the Reactor Cavity Sump around the Incore Instrumentation Tunnel, on the Recirculation Sump trenches, and at the Containment Sump. Flow channeling barrier gates are installed in the northeast and northwest quadrant openings of the Crane Wall. In addition, flow channeling barrier gates are installed in the north and south entrances to the Recirculation Sump area. There is one dual access gate (gates 17 and 23) to allow access without violating the flow barrier integrity during transient through the flow barrier system.

comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by intemet e-mail to Investigation of the event determined that the scaffold work group was the largest group within containment during the time the scaffold job on the 46 foot elevation was being worked. In accordance with procedure OAP-007 (Containment Entry and Egress) the scaffold group was to assume the role of containment coordinator and be responsible for performing a containment entry briefing. However, instead of providing a containment entry briefing, a regular or standard HU pre-job brief was given to the scaffold workers by their contractor supervisor. Because the area being worked was a radiation controlled area the scaffold workers then met with Radiation Protection (RP) personnel at the Health Physics access (HP1) for a Locked High Radiation Area (LHRA) RP pre-job brief. The RP brief included discussion that one of the ECCS barrier gates had to be closed at all times per GSI-191 and OAP-007 requirements. The job also required an RP door guard whose only function was to ensure that anyone entering into the inside crane wall had to have an HP individual with them. There was no ECCS barrier gate monitor assignment as required by OAP- 007. As work progressed the scaffold workers left both ECCS barrier gates open to enhance removal of scaffold material to storage. Although the scaffold workers were told during the RP briefing that one ECCS barrier gate must remain closed at all times, it was discovered in interviews with workers that they thought that none of the other gates could be opened while they were using their gate location to remove scaffold.

It was determined that the supplemental scaffold supervisor was not aware of a specific entry procedure that was required to be used prior to a containment entry.

A specific OAP-007 procedure containment entry brief was not given to the workers nor were they and their supervisor aware of the procedure. The supplemental scaffold group supervisor stated that in previous containment entries he and his group were never the main group going into containment so they were always briefed by operations or RP and didn't recall using OAP-007. Procedure OAP-007 is specifically written to cover many aspects of containment entries. The procedure contains sections and steps discussing the ECCS barrier gates with diagrams of the crane wall and all of the gates with their locations and numbers. If the procedure had been used in addition to a pre-job and RP brief, the requirements would have been clearer to the workers and this event most likely would not have occurred.

An extent of condition (EOC) review was performed and it determined that both units are similar and both would be vulnerable in an event if there was a direct flow path for accident debris to enter the containment/internal recirculation sump. The condition is bounded by the crane wall gates as these are the only types of gates in the containment installed in the crane wall that protect the ECCS sumps from debris.

comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by intemet e-mail to

CAUSE OF EVENT

The apparent cause was a latent organizational weakness associated with the use of procedure OAP-007 (Containment Entry and Egress) which had not been communicated well within the organization. The failure mode was personnel not being aware of all available information. The scaffold supervisor was not aware of his requirement to serve as containment coordinator and provide the required briefing on gate closure. The RP brief was focused on the locked high radiation requirements not gate control.

CORRECTIVE ACTIONS

The following corrective actions have been or will be performed under the Corrective Action Program (CAP) to address the causes of this event:

• Dual gates were closed and applicable gate secured. The RP door guard was coached on requirement to have at least one gate closed and secured at all times.

• A HU meeting was held and interviews conducted with the work crew, supervisor and RP personnel and the requirements of OAP-007 were reviewed and requirements of the ECCS barrier reinforced.

• A Department Clock Reset/Yellow memo was prepared and the lessons learned on the event and management expectations communicated with Projects organizations, all site departments, and the Fleet.

• The event will be included in all 3R19 supplemental supervisors qualifications required reading list.

• Procedure OAP-007 will be revised to include a checklist for entry briefings to include GS-191 requirements.

EVENT ANALYSIS

The event is reportable under 10CFR50.73(a)(2)(v)(D) as a safety system functional failure as the condition could have prevented adequate post accident core cooling due to DBA debris blockage of the recirculation and/or the containment sump. An ECCS train is inoperable if it is not capable of delivering design flow to the RCS.

Individual components are inoperable if they are not capable of performing their design function or supporting systems are not available. Technical Specification (TS) 3.5.2 (ECCS-Operating) requires three ECCS trains to be operable in Modes 1, 2 and 3, and TS 3.5.3 (ECCS-Shutdown) requires one ECCS residual heat removal (RHR) subsystem and one ECCS recirculation subsystem to be operable in Mode 4.

comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by intemet e-mail to Indian Point 2 05000-247 The licensing and design basis of the ECCS per UFSAR Section 6.2.2 (ECCS System Design and Operation) credits flow channeling barriers installed in containment in response to the resolution of GL-2004-02. The two flow barrier gates that were used for removing scaffolding were not closed and secured to prevent it from being forced open during a DBA. The unsecured gates were not in accordance with design and not a sufficient robust barrier to prevent debris from entering the recirculation and containment sumps had a DBA occurred while in Mode 4. The condition is also reportable under 10CFR50.73(a)(2)(vii) (common cause inoperability of independent trains or channels) as the condition caused at least one independent train or channel to become inoperable in multiple systems or two independent trains or channels to become inoperable in a single system designed to (D) mitigate the consequences of an accident. The NRC inspector tour occurred during the time the unit was in Mode 4. The unit entered Mode 4 on June 10, 2016, at 23:30 hours. However, no CR was initiated for this condition at that time. CR- IP2-2016-04037 recorded that condition that while performing a walkdown with an NRC inspector on June 11, 2016, the NRC raised a question about an activity in the field and no condition report was initiated.

PAST SIMILAR EVENTS

A review was performed of the past three years of Licensee Event Reports (LERs) for events that involved SSFFs and/or common cause inoperability of an Engineered Safety Feature System that had a similar cause. No LERs were identified at Unit 2.

A review of all reported events during the past three years at both units identified one LER at Unit 3 that was similar. Unit 3 LER-2013-002 reported on April 29, 2013, a Safety System Functional Failure and Common Cause Inoperability of the Emergency Core Cooling System due to violation of containment sump debris barrier integrity. The LER reported that on March 4, 2013, during shutdown for a refueling outage, Radiation Protection (RP) personnel entered the reactor containment building to install plastic RP fencing for the Reactor Coolant Drain Tank (RCDT). After receiving clearance at Mode 4 to enter the Inner Crane Wall (ICW) to install fencing around the RCDT and post it as a Locked High Radiation Area (LHRA). The RP work crew assumed they could enter the ICW area through any sump barrier gate for the Emergency Core Cooling System (ECCS). The RP work crew chose to use a single gate access point due to its proximity to the RCDT.

Subsequently, a RP Technician identified that personnel had not entered the area using the double access gate and had brought in plastic fencing which was inappropriate material for the sump area. The apparent causes were an inadequate pre-job brief and inadequate procedure for Containment Entry and Egress (OAP-007, 0-RP-RWP-405) due to poor change management. The pre-job brief failed to cover the requirement to use the dual sump barrier gate access point when in Modes 1-4, nor did it address the type of fencing allowed. Corrective actions included revision of Procedure OAP-007 to clearly state that within the procedure's attachments that only the sump barrier dual access gate for 46 foot Containment ICW entries shall be used in Modes 1-4.

comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by intemet e-mail to The revision specified the use of the double entry gate and that one gate is to remain shut and secured at all times. Securing the gates at unit 3 which uses a slide latch does not state the use of a gate monitor. The step for Unit 2 includes statements that the gates be secured with a padlock or nut and bolt closure from the outside. This condition requires posting of a gate monitor to allow exit.

SAFETY SIGNIFICANCE

This event had no significant effect on the health and safety of the public. There were no actual safety consequences for the event because there were no accidents or transients during the time of the event. The analysis performed in response to GL- 2004-02 included debris transport analysis conservatisms for transport of debris to both the IR sump and the Containment sump in excess of quantities that would be generated. Establishing normal RHR cooling to the RCS has RCS temperature below 350 degrees F and pressure less than 400 psig.

In Mode 4 the reactor is not critical and reactivity is stable. In Mode 4 there is significantly less energy in the RCS to generate debris. At the time the actual RCS pressure (pressurizer pressure) was approximately 355 psig. An evaluation of a LOCA during Mode 3 and 4 operation was performed by Westinghouse (WCAP-12476) that showed a direct reduction in break probability for Mode 4. The evaluation concluded that Mode 4 LOCAs are not a significant contributor to shutdown risk.

During this event the entire flow barrier was not disabled because only two debris barrier gates were unsecured and only for the time scaffold workers were allowed to perform assigned work. The exact time the gates were open cannot be determined as the barrier gates have no electronic timing devises. However, the scaffold workers were assigned three entries with stay time limitations for heat stress of 45 minutes each for a total job time of 135 minutes. The scaffold work assignment took place in Mode 4. The unit entered Mode 4 on June 10, 2016, at 23:30 hours.

For the first two of three entries, the scaffold workers had to go inside the crane wall and disassemble erected scaffolding. Per the scaffold supervisor at least one door was closed during scaffold disassembly. Therefore approximately 60 minutes were left for moving disassembled scaffolding from inside the crane wall through the open gates to the outside crane wall storage areas. Therefore most debris would have been intercepted by the flow barrier system. Also, the barrier gates swing into the crane wall so that DBA flow and forces would tend to close the gate when pressure is applied (e.g., DBA debris loads) therefore limit flow barrier bypass and sump debris loading.