05000259/LER-2012-004
| Docket Numbersequential Revmonth Day Year Year Month Day Yearnumber No. Bfn Unit 2 05000260 | |
| Event date: | 03-14-2012 |
|---|---|
| Report date: | 12-26-2012 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition |
| 2592012004R01 - NRC Website | |
I. PLANT CONDITION(S)
At the time of discovery, Browns Ferry Nuclear Plant (BFN), Units 1, 2, and 3, were in Mode 1 at approximately 100 percent rated thermal power.
II. DESCRIPTION OF EVENT
A. Event:
On March 14, 2012, at 1416 Central Daylight Time (CDT), the National Fire Protection Association (NFPA) 805 transition review identified a 10 CFR 50 Appendix R non-conforming condition associated with the spurious start of a Residual Heat Removal Service Water (RHRSW) pump [P] due to cable [CBL] damage during an Appendix R fire. The spurious start of this pump could overload the Emergency Diesel Generator (EDG) [DG] associated with the shutdown board that powers the pump. This event would likely result in a drop in the EDG's voltage and frequency. However, there is a possibility that the resulting overload condition could cause the EDG to fail. This condition does not conform to 10 CFR 50 Appendix R Section III.G.2. The current configuration is the result of a latent design error made prior to the BFN Unit 2 restart in 1991. The error was carried through the restart of BFN Unit 3 in 1995 and the restart of BFN Unit 1 in 2007. 10 CFR 50 Appendix R became effective in 1981.
Limit switches or relays [RLY] provide input to Emergency Equipment Cooling Water (EECW) [CC] auto start logic for RHRSW pumps Al , BI, C1, and Dl. Fire damage to the cables associated with these limit switches and relays can cause these RHRSW pumps to spuriously start upon an EECW automatic initiation signal.
It would require a hot short around the limit switch or relay contact followed by an Emergency Core Cooling System (ECCS) auto initiation signal in order for this event to occur. The short would give a false indication that the pump was aligned to the EECW system. This would allow the pump to start on an EECW auto start signal. Also, the short would have to not go to ground or cause the isolating fuse [FU] to clear in order for this event to occur.
Under this fire scenario, operator actions would isolate the breaker [BKR] for the affected pump using the normal/emergency backup control switch [JS] located at the breaker. However, the control switch does not bypass an EECW auto start signal. Therefore the pumps are still able to spuriously auto start, and the EDG loading could be impacted.
Previous reviews of the BFN design for compliance with 10 CFR 50 Appendix R, documented in January 1986, failed to address this non-conformance.
Compensatory actions in the form of fire watches to mitigate this condition are in place in accordance with the BFN Fire Protection Report.
This condition was originally determined, based on a preliminary evaluation, not to be reportable. During subsequent review and completion of the evaluation, this condition was determined to be reportable and the NRC was notified in accordance with 10 CFR 50.72(b)(3)(ii)(B) on March 28, 2012, at 2144 CDT. While performing the Extent of Condition associated with this issue, additional RHRSW pumps were identified as having the potential to spuriously start. The NRC was notified in accordance with 10 CFR 50.72(b)(3)(ii)(B) on April 13, 2012, at 1831 CDT.
B. Inoperable Structures, Components, or Systems that Contributed to the Event:
There were no inoperable structures, components, or systems that contributed to this event.
C. Dates and Approximate Times of Major Occurrences:
February 19, 1981 Initial issue of 10 CFR 50 Appendix R became effective.
January 1986 Review of BFN design for compliance with 10 CFR 50 Appendix R documented.
March 14, 2012, at 1416 CDT NFPA 805 review identified a potential 10 CFR 50 Appendix R non-conforming condition associated with the spurious start of a RHRSW pump due to cable damage during a fire.
March 28, 2012, at 2144 CDT TVA reported condition to the NRC.
April 13, 2012, at 1831 CDT As a result of Extent of Condition reviews, TVA reported the expanded condition to the NRC.
D. Other Systems or Secondary Functions Affected
There were no other systems or secondary functions affected.
E. Method of Discovery
The issue was identified during the NFPA 805 transition review.
F. Operator Actions
There were no operator actions.
G. Safety System Responses
There were no safety system responses.
III. CAUSE OF THE EVENT
A. Immediate Cause
The immediate cause of this issue is a RHRSW pump could spuriously start due to cable fire damage resulting in the associated EDG overloading. There is a possibility that overloading an EDG could result in EDG failure.
B. Root Cause
The cause of this condition was identified as human performance errors by engineers.
C. Contributing Factors
There were no contributing factors.
IV. ANALYSIS OF THE EVENT
TVA is submitting this report in accordance with 10 CFR 50.73(a)(2)(ii)(B), any event or condition that results in the nuclear power plant being in an unanalyzed condition that significantly degraded plant safety.
During the NFPA 805 transition review, a 10 CFR 50 Appendix R non-conforming condition associated with the spurious start of a RHRSW pump due to cable damage during an Appendix R fire was identified. The spurious start of this pump could overload the EDG associated with the shutdown board that powers the pump. An EDG overload would likely result in a drop in the EDG's voltage and frequency; however an overload could cause the EDG to fail.
An overload condition would have an adverse impact on EDG A for a fire event in Fire Area (FA) 2-4 and FA 3-3, and on EDG B for a fire event in FA 25-1. The maximum short-time steady-state power output of the EDGs for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> in a 24-hour period is 2800 kilowatts (kW). The additional load from an RHRSW pump is 328 kW. The Appendix R fire is assumed to be put out in the first hour and any spurious operation of this pump would be seen during this fire damage period. Once the fire is extinguished, the potential for new shorts ceases (at the 60-minute mark).
In the analysis of a fire in FA 2-4, EDG A has a listed maximum loading of 2597 kW and in the analysis of a fire in FA 3-3, EDG A has a listed maximum loading of 2783 kW.
The Safe Shutdown Instructions (SSIs) for both FAs have EDG A started at 20 minutes (earlier, if off site power is lost) and aligned to supply power to shutdown board A. All of the 4kV loads on the shutdown board are stripped off of the board except for the 4kV to 480V transformer breakers (480V shutdown board 1A and 480V Diesel auxiliary board 1A). If the RHRSW pump Al spuriously started without a Residual Heat Removal (RHR) [BO] pump running, EDG A and shutdown board A [ECBD] would not be overloaded. At approximately the 2-hour point, the credited RHR pump and RHRSW pump are started.
However, they are also started when either drywell temperature exceeds 280°F or when the suppression pool temperature exceeds 140°F. Therefore, if the spurious actuation of an RHRSW pump occurred while the credited RHR pump and RHRSW pump are in service, then EDG A would be overloaded by 125 kW for FA :2-4 and by 311 kW for FA 3-3.
EDG B is credited in the analysis for a fire in FA 25-1 and for a fire in FA 25-1 and has a listed maximum loading of 2705 kW. In response to a fire in FA 25-1, Operations personnel are allowed to remain in the Emergency Operating Instructions (E01s) during the fire event and they may start RHR for suppression pool cooling earlier than the analyzed required time of 90 minutes. If the spurious start occurred prior to a 2C RHR pump or RHRSW pump C2 being in service, EDG B would have margin to accommodate the load. However, if the spurious RHRSW pump Cl start occurred after a 2C RHR pump and RHRSW pump C2 was in service, EDG E3 would be overloaded by 233 kW. All of the SSIs have precautions to monitor EDG loading and to secure non designated loads. If operations noticed the spurious start and secured the RHRSW pump Al before starting the RHR Pump 1A; then EDG A would not be overloaded.
Once the RHRSW pump is secured after a spurious start, it is locked out from a second auto start.
Extent of Condition While performing the extent of condition for RHRSW pumps Al through D1, the four EECW pumps A3 through D3 were identified as having similar circuitry. The EECW system is supplied by RHRSW pumps that are assigned duty as EECW system pumps.
RHRSW pumps A3 through D3 are dedicated to EECW with pumps Al through D1 as alternates. The two EECW pumps A3 and C3 auto start on any Unit 3 EDG (EDG 3A, 3B, 3C, and 3D) start, or any Unit 3 Core Spray [BG][BM] pump start. The EECW pumps B3 and D3 auto start on any Unit 1/2 EDG (EDG A, B, C, and D) start or any Unit 1 or 2 Core Spray pump start. All four of the EECW pumps will start on a Common Accident Signal or on low Raw Cooling Water (RCW) System [BI] header pressure. These EECW pumps are not prevented from auto-starting by the normal/emergency backup control switch and in some cases the SSIs are insufficient to prevent these EECW pumps from overloading an EDG.
Further analysis determined that EDG A for a fire in FA 21; EDG D for fires in FA 2-3 and FA 9; EDG 3C for fires in FA 1-1, FA 1-3, and FA 20; and EDG 3D for fires in FA 1-1, FA 1-3, FA 1-4, and FA 20 could exceed the maximum 2-hour rated EDG loading due to the potential for an automatic or spurious start of a RHRSW pump that supplies EECW to essential safety equipment.
V. ASSESSMENT OF SAFETY CONSEQUENCES
This issue has a potentially significant safety impact since the capability to supply power to the Appendix R safe shutdown equipment for the credited EDG is necessary to provide adequate core cooling and decay heat removal during performance of the BFN SSIs during an Appendix R fire. However, the Probabilistic Risk Assessment (PRA) for the condition concluded very few credible fires could impact the subject cables. The potential fire frequency was determined to be below 4.29 E-5/yr.
The PRA for the issue identified in the extent of condition considered fires that would require entry into BFN SSI procedures. The EDG overload concern related to EECW pumps is limited to those conditions of limited electrical distribution system capacity as a result of protective actions and aligned configurations in the SSIs; if the SSIs are not entered, the start of the EECW pump would not adversely impact the electrical distribution system, e.g., EDGs. The potential of SSI entry was determined, from the PRA, to be below 8.35 E-5/yr.
Based on this analysis, this condition is of low safety significance and posed little risk to public health and safety.
VI. CORRECTIVE ACTIONS - The corrective actions are being managed by TVA's corrective action program.
A. Immediate Corrective Actions
There were no immediate corrective actions.
B. Corrective Actions
1. Implemented modification to reconfigure the wiring of RHRSW pumps Al, BI, C1, D1, A3, B3, C3, and D3 to eliminate the potential of EDG overloading due to RHRSW pump auto start.
2. Conducted the following training of engineering personnel:
(i) Technical Conscious Training (ii) Technical Human Performance Training (iii) Design Input Training
VII. ADDITIONAL INFORMATION
A. Failed Components
There were no failed components.
B. Previous Similar Events
A search of BFN LERs for Units 1, 2, and 3, for approximately the past five years did not identify any similar events. However, LERs 50-259/2012-001-00, 50-259/2012-002-00, and 50-259/2012-003-00 were submitted as a result of conditions that were discovered during NFPA 805 transition reviews.
A search was performed on the BFN corrective action program. Previous similar Problem Evaluation Reports (PERs) related to NFPA 805 spurious operations include PERs 229734, 245385, 259787, 422371, 424389, 452185, 468127, and 503304.
C. Additional Information
The corrective action document for this report is PER 521739.
D. Safety System Functional Failure Consideration:
This condition is not considered to be a safety system functional failure in accordance with NEI 99-02.
E. Scram With Complications Consideration:
This condition did not include a reactor scram.
VIII. COMMITMENTS
There are no commitments.