05000296/LER-2015-001, Regarding High Pressure Coolant Injection and Reactor Core Isolation Cooling Inoperable Due to No Suction Source Aligned
| ML15114A289 | |
| Person / Time | |
|---|---|
| Site: | Browns Ferry  |
| Issue date: | 04/13/2015 |
| From: | Polson K Tennessee Valley Authority |
| To: | Document Control Desk, Office of Nuclear Reactor Regulation |
| References | |
| LER 15-001-00 | |
| Download: ML15114A289 (10) | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(A), Completion of TS Shutdown 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(i) 10 CFR 50.73(a)(2)(ii)(A), Seriously Degraded 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition 10 CFR 50.73(a)(2)(iii) 10 CFR 50.73(a)(2)(iv)(A), System Actuation 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor 10 CFR 50.73(a)(2)(v)(B), Loss of Safety Function - Remove Residual Heat 10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability 10 CFR 50.73(a)(2)(viii)(A) 10 CFR 50.73(a)(2)(viii)(B) 10 CFR 50.73(a)(2)(ix)(A) 10 CFR 50.73(a)(2)(x) |
| 2962015001R00 - NRC Website | |
text
Tennessee Valley Authority, Post Office Box 2000, Decatur, Alabama 35609-2000 April 13, 2015 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, D.C. 20555-0001
Subject:
Browns Ferry Nuclear Plant, Unit 3 Renewed Facility Operating License No. DPR-68 NRC Docket No. 50-296 Licensee Event Report 50-296/2015-001-00 10 CFR 50.73 The enclosed Licensee Event Report provides details of the concurrent inoperability of the Browns Ferry Nuclear Plant, Unit 3, High Pressure Coolant Injection and Reactor Core Isolation Cooling systems. The Tennessee Valley Authority (TVA) is submitting this report in accordance with Title 10 of the Code of Federal Regulations (10 CFR) 50. 73(a)(2)(v)(A),
(B), and (D), as any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to shut down the reactor and maintain it in a safe shutdown condition, remove residual heat, and mitigate the consequences of an accident.
There are no new regulatory commitments contained in this letter. Should you have any questions concerning this submittal, please contact J. L. Paul, Nuclear Site Licensing Manager, at (256) 729-2636.
Respectfully,
~#-
Site Vice President
Enclosure:
Licensee Event Report 50-296/2015-001 High Pressure Coolant Injection and Reactor Core Isolation Cooling Inoperable Due To No Suction Source Aligned cc (w/ Enclosure):
NRC Regional Administrator - Region II NRC Senior Resident Inspector - Browns Ferry Nuclear Plant
ENCLOSURE Browns Ferry Nuclear Plant Unit 3 Licensee Event Report 50-296/2015-001-00 High Pressure Coolant Injection and Reactor Core Isolation Cooling Inoperable Due To No Suction Source Aligned See Enclosed
NRC FORM 366 U.S. NUCLEAR REGULATORY COMMISSION (01-2014)
LICENSEE EVENT REPORT (LER)
APPROVED BY OMB NO. 3150-0104 EXPIRES 01/31/2017
, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.
- 1. FACILITY NAME Browns Ferry Nuclear Plant, Unit 3
- 2. DOCKET NUMBER 05000296
- 3. PAGE 1 of 8
- 4. TITLE: High Pressure Coolant Injection and Reactor Core Isolation Cooling Inoperable Due To No Suction Source Aligned
- 5. EVENT DATE
- 6. LER NUMBER
- 7. REPORT DATE
- 8. OTHER FACILITIES INVOLVED MONTH DAY YEAR YEAR SEQUENTIAL NUMBER REV NO.
MONTH DAY YEAR N/A N/A 02 11 2015 2015 - 001 - 00 04 13 2015 N/A N/A
- 9. OPERATING MODE
- 11. THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR §: (Check all that apply) 1 20.2201(b) 20.2201(d) 20.2203(a)(1) 20.2203(a)(2)(i) 20.2203(a)(2)(ii) 20.2203(a)(2)(iii) 20.2203(a)(2)(iv) 20.2203(a)(2)(v) 20.2203(a)(2)(vi) 20.2203(a)(3)(i) 20.2203(a)(3)(ii) 20.2203(a)(4) 50.36(c)(1)(i)(A) 50.36(c)(1)(ii)(A) 50.36(c)(2) 50.46(a)(3)(ii) 50.73(a)(2)(i)(A) 50.73(a)(2)(i)(B) 50.73(a)(2)(i)(C) 50.73(a)(2)(ii)(A) 50.73(a)(2)(ii)(B) 50.73(a)(2)(iii) 50.73(a)(2)(iv)(A) 50.73(a)(2)(v)(A) 50.73(a)(2)(v)(B) 50.73(a)(2)(v)(C) 50.73(a)(2)(v)(D) 50.73(a)(2)(vii) 50.73(a)(2)(viii)(A) 50.73(a)(2)(viii)(B) 50.73(a)(2)(ix)(A) 50.73(a)(2)(x) 73.71(a)(4) 73.71(a)(5)
OTHER Specify in Abstract below or in B. Status of structures, components, or systems that were inoperable at the start of the event and that contributed to the event:
There were no structures, components, or systems that were inoperable at the start of the event and that contributed to the event.
C. Dates and approximate times of occurrences
February 11, 2015, at 0730 Central Standard Time Operations personnel commenced surveillance procedure 3-SR-3.5.1.2 (HPCI).
February 11, 2015, at 0820 Central Standard Time Breaker 3-BKR-2-166 closed.
Isolation valve 3-FCV-2-166 spuriously closed.
HPCI and RCIC were declared inoperable due to no suction source aligned, and entered applicable TS actions.
February 11, 2015, at 0824 Central Standard Time Isolation valve 3-FCV-2-166 remotely opened from the Unit 1 Control Room.
Breaker 3-BKR-2-166 opened.
Operations declared HPCI and RCIC Operable following alignment of the CST for suction and exited applicable TS actions.
February 11, 2015, at 1516 Central Standard Time NRC was notified.
D. Manufacturer and model number (or other identification) of each component that failed during the event:
Hand switch [HS] 3-HS-2-166B was installed during initial construction. The manufacturer could not be identified.
E. Other systems or secondary functions affected
There were no other systems or secondary systems affected.
F. Method of discovery of each component or system failure or procedural error
On February 11, 2015, at approximately 0820 Central Standard Time, Operations personnel identified that isolation valve 3-FCV-2-166 inadvertently closed when its associated breaker was closed.
G. The failure mode, mechanism, and effect of each failed component, if known:
The cause for the inadvertent closure of isolation valve 3-FCV-2-166 was contacts on local hand switch 3-HS-2-166B being stuck closed when they should have been open.
H. Operator actions
Operations personnel declared Unit 3 HPCI and RCIC inoperable due to no suction source aligned and entered TS LCO 3.5.1 Condition G for HPCI inoperability and TS LCO 3.5.3 Condition B for RCIC inoperability.
Operations personnel re-opened isolation valve 3-FCV-2-166 using hand switch 3-HS-2-166B in the Unit 1 Control Room and when the valve indicated full open, directed the operator in the field to open the breaker for 3-FCV-2-166 to prevent further movement.
Operations personnel declared Unit 3 HPCI and RCIC Operable following alignment of the CST for suction, and exited TS LCO 3.5.1 Condition G and TS LCO 3.5.3 Condition B.
I. Automatically and manually initiated safety system responses
There were no automatic or manual safety system responses associated with this event.
III.
Cause of the event
A. The cause of each component or system failure or personnel error, if known:
The direct cause of this event was determined to be contacts on local hand switch 3-HS-2-166B being stuck closed instead of open.
B. The cause(s) and circumstances for each human performance related root
cause
The apparent cause of the event was determined to be inadequate design review of Design Change Notice (DCN) 69786 which allowed latent design vulnerabilities to be introduced into the plant.
Specifically, the assumption, that breakers required by TS to be closed regularly for maintenance would remain open as the sole means of preventing spurious valve closures, introduced a vulnerability into safety-related systems.
A more thorough design review may have revealed this vulnerability and ultimately prevented the event from occurring by demonstrating the need for an alternate means of preventing spurious valve closure.
IV.
Analysis of the event
The Tennessee Valley Authority (TVA) is submitting this report in accordance with Title 10 of the Code of Federal Regulations (10 CFR) 50.73(a)(2)(v)(A), (B), and (D), as any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to shut down the reactor and maintain it in a safe shutdown condition, remove residual heat, or mitigate the consequences of an accident.
The safety function of HPCI is to assure that the reactor is adequately cooled to limit fuel cladding temperature in the event of a small break in the nuclear system and loss of coolant which does not result in rapid depressurization of the reactor vessel. The safety function of RCIC is to provide makeup water to the reactor vessel during shutdown and isolation from the main heat sink to supplement or replace the normal makeup sources and operate automatically in time to obviate any requirement for the Core Standby Cooling Systems. Because the suction source was isolated, HPCI and RCIC were unable to perform their safety functions.
DCN 69786 was implemented on September 13, 2010, and changed the configuration of the breaker from normally closed to normally open to address fire concerns. This required a subsequent change in surveillance procedure 3-SR-3.5.1.2 (HPCI), which added the requirement for Operations personnel to close the breaker in order to verify the valve position. It was assumed during the design change process that the breakers for this isolation valve would remain open at all times, eliminating the requirement for redundant measures against spurious valve closure. The impacts of assumptions made by previous design changes were inadequately addressed; therefore, the design review for DCN 69786 was inadequate, which allowed latent design vulnerabilities to be introduced into the plant.
V.
Assessment of Safety Consequences
This event resulted in inoperability and unavailability of the single trains of the BFN, Unit 3, HPCI and RCIC systems resulting in the inability of the HPCI and RCIC systems to perform their safety functions for shutting down the reactor and maintaining it in a safe shutdown condition, mitigation of the consequences of an accident, and the removal of residual heat in the event that the reactor was shut down.
Several alternate methods were available to Operations personnel in the event of an emergency to provide core cooling, safe and sustainable shutdown of the reactor, residual heat removal, and mitigation of accident consequences. Cross-tie valves allowed for taking HPCI and RCIC suction from four other available CSTs. The ability to align HPCI suction to the Unit 3 suppression pool was also present.
For Design Basis Accidents, in the event of inoperability of HPCI and RCIC systems due to lack of a suction source, adequate core cooling is ensured by the operability of the other low pressure ECCS injection/spray subsystems in conjunction with the ADS.
BFN Unit 3 Operations logs were reviewed to determine if ADS or the low pressure ECCS were inoperable during the time period of the HPCI system inoperability. The results of the review are as follows.
For ADS, all ADS valves were operable during the time period and ADS initiation capability was maintained during this time period.
For the low pressure ECCS subsystems, i.e., two Core Spray [BM] subsystems and two Low Pressure Coolant Injection [BO] subsystems, all low pressure ECCS subsystems were operable during the time period. Low pressure ECCS initiation capability was also maintained during this time period. With HPCI and RCIC inoperable, operable low pressure ECCS subsystems and ADS are capable of providing adequate core cooling in the event of a design basis accident or transient.
Based on the above, during the time period that the HPCI and RCIC systems were inoperable, sufficient systems were available to provide the required safety functions to protect the health and safety of the public. Therefore, TVA has concluded that there was no significant reduction to the health and safety of the public or plant personnel for this event.
A. Availability of systems or components that could have performed the same function as the components and systems that failed during the event:
During this event, all other ECCS and ADS systems remained operable.
B. For events that occurred when the reactor was shut down, availability of systems or components needed to shut down the reactor and maintain safe shutdown conditions, remove residual heat, control the release of radioactive material, or mitigate the consequences of an accident:
This event did not occur when the reactor was shut down.
C. For failure that rendered a train of a safety system inoperable, an estimate of the elapsed time from discovery of the failure until the train was returned to service:
This event resulted in inoperability of the BFN, Unit 3, HPCI and RCIC systems for approximately four minutes from the time the isolation valve was isolated until the isolation valve was remotely opened.
VI.
Corrective Actions
Corrective Actions are being managed by TVAs corrective action program under Problem Evaluation Report 988444.
Interim Corrective Actions 1.
Removed thermal overload heaters from isolation supply valve breakers 3-BKR-2-166, 1-BKR-2-170, and 2-BKR-2-162 to prevent valve closure when breaker is closed for valve position verification.
2.
Repaired faulty hand switch 3-HS-2-166B.
Corrective Actions To Reduce Probability of Similar Events Occurring in the Future The following corrective actions reduce the likelihood of recurrence:
1.
System Engineering Supervisors to review 15 engineering change packages, chosen based on risk and complexity, which were implemented between January 2010 and December 2014 for quality of the Design Review. Provide feedback where strengths or gaps are identified. Initiate Service Requests for any conditions adverse to quality or potential adverse trends.
2.
Issue engineering change packages for all three BFN units to prevent spurious operation of CST isolation valves while allowing Operations personnel to close the CST isolation valve breakers each month for valve position verification as required by surveillance procedures 1/2/3-SR-3.5.1.2, ECCS Monthly Valve Position Verification, and 1/2/3-SR-3.5.3.2, RCIC System Monthly Valve Position Verification.
VII.
Additional Information
A. Previous similar events at the same plant:
A search of Licensee Event Reports and corrective action program documents revealed that no similar events are known to have occurred at any BFN unit over the past three years.
B. Additional Information
There is no additional information.
C. Safety System Functional Failure Consideration:
This event resulted in the inability of the BFN, Unit 3, HPCI and RCIC systems to perform their safety functions for safe and sustainable shutdown of the reactor, mitigation of the consequences of an accident, and removal of residual heat in the event that the reactor was shut down. In accordance with NUREG-1022, this event is considered a safety system functional failure.
D. Scram with Complications Consideration:
This event did not result in a reactor scram.
VIII. COMMITMENTS
There are no new commitments.