05000259/LER-2015-001

LER-2015-001, 1 of 7

Browns Ferry Nuclear Plant (Bfn), Unit 1
Event date:	02-21-2015
Report date:	04-22-2015
2592015001R00 - NRC Website

I. Plant Operating Conditions Before the Event

At the time of discovery, Browns Ferry Nuclear Plant (BFN) Units 1, 2, and 3 were operating in Mode 1 at approximately 100 percent rated thermal power.

II. Description of Events

A. Event:

On February 21, 2015, at approximately 2300 Central Standard Time (CST), during the performance of monthly operability surveillance procedure 0-SR-3.8.1.1 (B), Operations personnel identified the "D" Emergency Diesel Generator (DG)[DG][EK] control switch [HS] 0-HS-82-D/1A was in the "pulled out" stop position. When the control switch was in this position, the DG's control logic would have prevented the generator from starting upon receiving an auto-start signal. This would have resulted in a failure of the DG to perform its designed safety function. Therefore, on February 21, 2015, at approximately 2300 CST, Operations personnel declared the "D" DG inoperable.

Since one of the required Unit 1 and 2 DGs ("D" DG) was inoperable, Technical Specifications (TS) Limiting Conditions for Operation (LCO) 3.8.1 Condition B was entered.

On February 22, 2015, at approximately 0008 CST, Operations personnel placed the "D" DG control switch 0-HS-82-D/1 A in the pushed in position, and exited Unit 1 and Unit 2 TS LCO 3.8.1 Condition B.

A Past Operability Evaluation (POE) was performed for this event. The POE concluded that the "D" DG was inoperable since the last operation of the control switch, approximately eight days earlier on February 13, 2015.

B. Status of structures, components, or systems that were inoperable at the start

of the event and that contributed to the event:

There were no structures, components, or systems that were inoperable at the start of the event and that contributed to the event.

C. Dates and approximate times of occurrences:

February 13, 2015, at 1337, CST Common Accident Signal Logic Surveillance, 0-SR-3.8.1.6, was performed. Last known instance where control switch was manipulated.

February 21, 2015, at 2300, CST Control switch discovered in the "pulled out" stop position.

"D" DG declared inoperable, but available.

February 22, 2015, at 0008, CST Control switch returned to the pushed in position.

"D" DG declared operable.

D. Manufacturer and model number (or other identification) of each component that failed during the event:

No component failures were identified that occurred during the event.

E. Other systems or secondary functions affected:

There were no other systems or secondary systems affected.

F. Method of discovery of each component or system failure or procedural error:

On February 21, 2015, at approximately 2300 CST, during the performance of "B" DG monthly operability surveillance, Operations personnel identified that control switch 0-HS-82-D/1A was in the "pulled out" stop position.

G. The failure mode, mechanism, and effect of each failed component, if known:

There were no failed components related to this event.

H. Operator actions:

Operations personnel declared "D" DG inoperable but available, and entered TS LCO 3.8.1 Condition B for inoperability of one required Unit 1 and 2 DG.

Operations personnel returned the control switch to the pushed in position.

Operations personnel declared "D" DG Operable, and exited TS LCO 3.8.1.

I. Automatically and manually initiated safety system responses:

There were no automatic or manual safety system responses associated with this event.

III. Cause of the event

A. The cause of each component or system failure or personnel error, if known:

The direct cause of the "D" DG inoperability was the "D" DG control switch being left in the "pulled out" stop position during the performance of surveillance procedure 0-SR-3.8.1.6, Common Accident Signal Logic.

B. The cause(s) and circumstances for each human performance related cause:

The apparent cause of the "D" DG control switch being left in the "pulled out" stop position was the Procurement Data Sheet (PDS) for the "D" DG control switch was incorrectly filled out in 2002. The incorrect PDS resulted in the "D" DG control switch 0-HS-82-D/1A being replaced in 2004 with one that did not contain a spring return, contrary to the original design. Procedure revisions made to incorporate the "D" DG control switch difference were not adequate to ensure the switch position was maintained in the correct configuration. The surveillance procedure included only directions to ensure the "D" DG control switch was pushed in after being stopped in one step, and was not included in the final step that stops the generator. Additionally, the extent of condition identified five other related procedures had not been revised to address the "D" DG control switch difference.

Operations personnel did not effectively utilize operator fundamentals and human performance tools when leaving the "D" DG control switch in the pulled out position, nor did they anticipate the impact of component operations prior to its operation, or verify that expected effects occurred during and following the operation.

The Corrective Action Program was ineffectively used to resolve this condition. The "D" DG Control Switch difference had been identified several times during the past, but was not corrected prior to this event. Identified issues with the switch were entered into the Corrective Action Program, but the cause analysis and review of the condition did not identify that the "D" DG Control Switch had been replaced with a switch that was not in accordance with the plant design.

IV. Analysis of the event:

The Tennessee Valley Authority (TVA) is submitting this report in accordance with Title 10 of the Code of Federal Regulations (10 CFR) 50.73(a)(2)(i)(B), as any operation or condition which was prohibited by the plant TS.

The safety objective of the Standby AC Power System is to provide a self-contained, highly reliable source of power, as required for the Engineered Safeguards System, such that no single credible event can disable the core standby cooling functions or their supporting auxiliaries. Specifically, no operator action should be required in the short term (minimum of ten minutes), and the DGs should be capable of being at rated speed and voltage and ready to accept load within ten seconds of receiving an automatic start signal and capable of carrying designated loads for a mission time of seven days. The mispositioned "D" DG control switch results in the inability of the engine to receive a start signal or provide power to the "D" 4kV Shutdown Board.

Thus, if a start signal had been sent to "D" DG, it would have failed to start.

On February 21, 2015, at approximately 2300 CST, Operations personnel declared the "D" DG inoperable after discovering the "D" DG control switch in the "pulled out" stop position. Since one of the required Unit 1 and 2 DGs ("D" DG) was inoperable, TS 3.8.1 Condition B was entered, which requires:

1. Verification of power availability from the offsite power network within one hour and once per eight hours thereafter.

2. Evaluation of availability of both Temporary DGs within one hour and once per twelve hours thereafter.

3. Declaration of required features, supported by the inoperable Unit 1 and 2 DG, inoperable when the redundant required features are inoperable within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> from discovery of Condition B concurrent with inoperability of redundant required features.

4. Determination that operable Unit 1 and 2 DGs are not inoperable due to common cause failure within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, or performance of SR 3.8.1.1 for operable Unit 1 and 2 DGs within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

5. Restoration of inoperable Unit 1 and 2 DG to operable status within seven days.

The POE determined the "D" DG had likely been inoperable for over eight days, which was longer than allowed by TS 3.8.1 Condition B. Failure to complete the required actions of the LCO due to exceeding the 7 day requirement would have required entry into TS LCO 3.8.1 Condition I.

Condition I requires the unit to be placed in Mode 3 (Hot Shutdown) within twelve hours and be placed in Mode 4 (Cold Shutdown) within thirty-six hours.

During the period of inoperability of "D" DG, the following DGs were inoperable for short durations:

• "3C" DG for 0.47 hours5.439815e-4 days <br />0.0131 hours <br />7.771164e-5 weeks <br />1.78835e-5 months <br /> on February 14, 2015

• "3D" DG for 0.68 hours7.87037e-4 days <br />0.0189 hours <br />1.124339e-4 weeks <br />2.5874e-5 months <br /> on February 15, 2015

• "A" DG for 2.72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> on February 21, 2015

• "3A" DG for 2.32 hours3.703704e-4 days <br />0.00889 hours <br />5.291005e-5 weeks <br />1.2176e-5 months <br /> on February 21, 2015

• "B" DG for 0.59 hours6.828704e-4 days <br />0.0164 hours <br />9.755291e-5 weeks <br />2.24495e-5 months <br /> on February 21, 2015 Due to the inoperability of the "A" and "B" DGs, BFN Units 1 and 2 should have entered TS LCO 3.8.1 Condition H, two or more DGs inoperable, with Required Action H.1 to restore one of the DGs to operable status within two hours. The Required Action was not met on February 21, 2015, with the inoperability of "A" DG, which would have required entry into LCO 3.8.1 Condition I.

Additionally, required offsite power circuits were inoperable for short durations:

• "A" 4kV Shutdown Board for 1.18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br /> on February 21, 2015

• "3A" 4kV Shutdown Board — 1.87 hours0.00101 days <br />0.0242 hours <br />1.438492e-4 weeks <br />3.31035e-5 months <br /> on February 21, 2015 This would have required entry into Units 1 and 2 TS LCO 3.8.1 Condition J due to "A" 4kV shutdown board offsite power circuit inoperable with "A" DG inoperable and "D" DG inoperable. Required Action J.1 requires entry into LCO 3.0.3 immediately.

LCO 3.0.3 was not initiated within one hour to place the unit in Mode 2.

Because "D" DG was inoperable from February 13, 2015, at 1337 CST, until February 22, 2015, at 0008 CST, BFN, Units 1 and 2, operated with the "D" DG inoperable for longer than allowed by TS LCO 3.8.1 Required Actions.

V. Assessment of Safety Consequences

This event resulted in the inoperability of the Unit 1 and 2 "D" DG, resulting in the inability of the "D" DG to perform its designed safety function.

During the period of "D" DG inoperability, five other DGs were also inoperable, at various times, for performance of SR 3.8.1.1, Diesel Generator Monthly Operability Test. This surveillance procedure requires three Operations personnel to be present in the field during the performance of the surveillance. Procedures applicable to BFN Units 1, 2, and 3 for out-of-service equipment allow such equipment to remain available if its function can be promptly restored by an operator in the control room or by a dedicated operator stationed locally for that purpose.

Therefore, during the period of the "D" generator's inoperability, all seven other DGs remained available for the purpose of fulfilling the DG safety functions. The requirement for three BFN Unit 1 and 2 DGs and three BFN Unit 3 DGs to be available for startup was met throughout the event in accordance with plant procedures.

A Probabilistic Risk Assessment (PRA) was performed due to the "D" DG unavailability.

The PRA concluded that the Incremental Core Damage Probability and Incremental Large Early Release Probability for the time period that the "D" DG was unavailable corresponds to green risk, or low safety significance.

Based on the above, TVA has concluded that during the time period that the "0" DG system was inoperable, there was no significant risk to the health and safety of the public or plant personnel as a result of this event.

A. Availability of systems or components that could have performed the same function as the components and systems that failed during the event:

During this event, all three other Unit 1 and 2 DGs remained available, although several DGs were inoperable for short periods of time during planned maintenance and/or testing.

During this event, all four Unit 3 DGs remained available, although several DGs were inoperable for short periods of time during planned maintenance and/or testing.

B. For events that occurred when the reactor was shut down, availability of systems or components needed to shutdown the reactor and maintain safe shutdown conditions, remove residual heat, control the release of radioactive material, or mitigate the consequences of an accident:

This event did not occur when the reactor was shut down.

C. For failure that rendered a train of a safety system inoperable, an estimate of the elapsed time from discovery of the failure until the train was returned to service:

This event resulted in inoperability of the DG for approximately eight days from the time the control switch was in the "pulled out" stop position for surveillance testing on February 13, 2015, at approximately 1337 CST, until the switch was discovered out of position and returned to pushed-in position on February 22, 2015, at 0008 CST.

VI. Corrective Actions:

Corrective Actions are being managed by TVA's Corrective Action Program under Problem Evaluation Report (PER) 990793.

Additionally, two previous PERs, 368630 and 549159, contain corrective actions taken prior to the event.

Prior Corrective Actions:

1. PER 368630 resulted in revision of the PDS for the control switch to specify that the switch action is to "spring-return" when pulled out. Additionally, any remaining incorrect switches were removed from the available material in stock.

2. PER 549159 required a gap analysis of PERs prior to 2012, which determined and corrected the causes of ineffective CAP during that time.

Immediate Corrective Actions:

Operations personnel placed the control switch in the pushed in position and verified that the stop relays were de-energized.

Corrective Actions to Reduce Probability of Similar Events Occurring In the Future:

1. Operations Procedure writers were briefed on the details of this event and the lessons learned.

2. Operations personnel involved in the event were coached on proper use of operator fundamentals and human performance tools when manipulating plant equipment.

3. "D" DG control switch was replaced with the correct control switch.

VII. Additional Information:

A. Previous Similar Events at the same plant:

A search of BFN Licensee Event Reports (LERs) for Units 1, 2, and 3 within the last five years did not identify any previous similar events.

A search of the BFN Corrective Action Program identified PER 368630.

PER 368630 was initiated in May 2011 to document that the material in stock for the DG start - stop control switch was incorrect. The PER did not evaluate the extent of condition to determine if the incorrect switch had been used as a replacement for any of the other DG control switches. This was a missed opportunity to identify that the "D" DG control switch had been replaced with the incorrect switch for installation in 2004.

The in-effective use of the Corrective Action Program to resolve this condition was identified as a contributing cause. This contributing cause was addressed by PER 549159. PER 549159 required a gap analysis of PERs prior to 2012, which determined and corrected the causes of ineffective CAP during that time.

B. Additional Information:

There is no additional information.

C. Safety System Functional Failure Consideration:

During the first ten minutes of design basis events, three of the Unit 1 and 2 DGs (A, B, C, D), with three of the Unit 3 DGs (3A, 3B, 3C, 3D) are required to automatically start and come to a ready-to-load condition, and must be capable of accepting automatically sequenced plant safety loads. Within the period of "D" DG inoperability, the other DGs in the same set remained available to perform their safety function. Therefore, in accordance with NUREG-1022, this event is not considered a safety system functional failure.

D. Scram with Complications Consideration:

This event did not result in a reactor scram.

VIII. COMMITMENTS

There are no new commitments.