05000260/LER-2016-001, Regarding High Pressure Coolant Injection Safety System Functional Failure Due to a Blown Fuse and a Failed Relay

Regarding High Pressure Coolant Injection Safety System Functional Failure Due to a Blown Fuse and a Failed Relay

ML16229A499
Person / Time
Site:	Browns Ferry
Issue date:	08/16/2016
From:	Bono S Tennessee Valley Authority
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
LER 16-001-00
Download: ML16229A499 (11)

LER-2016-001, Regarding High Pressure Coolant Injection Safety System Functional Failure Due to a Blown Fuse and a Failed Relay

Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(i)(A), Completion of TS Shutdown 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications
LER closed by
IR 05000259/2016000 (9 November 2016) IR 05000259/2016003 (9 November 2016)
2602016001R00 - NRC Website

text

Tennessee Valley Authority, Post Office Box 2000, Decatur, Alabama 35609-2000 August 16, 2016 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, D.C. 20555-0001

Subject:

Browns Ferry Nuclear Plant, Unit 2 Renewed Facility Operating License No. DPR-68 NRC Docket No. 50-260 Licensee Event Report 50-260/2016-001-00 10 CFR 50.73 The enclosed Licensee Event Report provides details of the High Pressure Coolant Injection Safety System Functional Failure due to a Blown Fuse and a Failed Relay. The Tennessee Valley Authority is submitting this report in accordance with Title 10 of the Code of Federal Regulations 50. 73(a)(2)(v)(D), as any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to mitigate the consequences of an accident.

There are no new regulatory commitments contained in this letter. Should you have any questions concerning this submittal, please contact J. L. Paul, Nuclear Site Licensing Manager, at (256) 729-2636.

Enclosure: Licensee Event Report 50-260/2016-001 High Pressure Coolant Injection Safety System Functional Failure due to a Blown Fuse and a Failed Relay cc (w/ Enclosure):

NRC Regional Administrator - Region II NRC Senior Resident Inspector - Browns Ferry Nuclear Plant

U.S. Nuclear Regulatory Commission Page 2 August 16, 2016 JLP:JKG Enclosure bee (w/ Enclosure):

NRC Project Manager - Browns Ferry Nuclear Plant K.S.Adams S. M. Bono T. J. Bradshaw T. M. Conner S. M. Douglas R. L. Gambone J.P. Grimes E. D. Schrull J. W. Shea P. B. Summers S. A. Vance EDMS

ENCLOSURE Browns Ferry Nuclear Plant Unit 2 Licensee Event Report 50-260/2016-001-00 High Pressure Coolant Injection Safety System Functional Failure due a Blown Fuse and a Failed Relay See Enclosed

NRC FORM 366 U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY OMB: NO. 3150-0104 EXPIRES: 10/31/2018 (11-2015)

~~(,""-. REG(ll'f>O

, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

3. PAGE Browns Ferry Nuclear Plant, Unit 2 05000260 1 OF8

4. TITLE High Pressure Coolant Injection Safety System Functional Failure due to a Blown Fuse and a Failed Relay

5. EVENT DATE

6. LER NUMBER

7. REPORT DATE

8. OTHER FACILITIES INVOLVED I

SEQUENTIAL I REV FACILITY NAME DOCKET NUMBER MONTH DAY YEAR YEAR NUMBER NO.

MONTH DAY YEAR N/A N/A 06 17 2016 2016 001 00 08 FACILITY NAME DOCKET NUMBER 16 2016 N/A N/A

9. OPERATING MODE

11. THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR §: (Check all that apply)

D 20.2201 (b)

D 20.2203(a)(3)(i)

D 50. 73(a)(2)(ii)(A)

D 50. 73( a)(2)(viii)(A) 1 D 20.2201 (d)

D 20.2203(a)(3)(ii)

D 50. 73(a)(2)(ii)(B)

D 50. 73(a)(2)(viii)(B)

D 20.2203(a)(1)

D 20.2203(a)(4)

D 50. 73( a)(2)(iii)

D 50. 73(a)(2)(ix)(A)

D 20.2203(a)(2)(i)

D 50.36(c)(1 )(i)(A)

D 50. 73( a)(2)(iv)(A)

D 50. 73( a)(2)(x)

10. POWER LEVEL D 20.2203(a)(2)(ii)

D 50.36(c)(1 )(ii)(A)

D 50. 73( a)(2)(v)(A)

D 73.71 (a)(4)

D 20.2203(a)(2)(iii)

D 50.36(c)(2)

D 50. 73(a)(2)(v)(B)

D 73. 71 (a)(5)

D 20.2203(a)(2)(iv)

D 50.46(a)(3)(ii)

D 50. 73(a)(2)(v)(C)

D 73.77(a)(1) 100 D 20.2203(a)(2)(v)

D 50.73(a)(2)(i)(A)

~ 50. 73(a)(2)(v)(D)

D 73.77(a)(2)(i)

D 20.2203(a)(2)(vi)

D 50.73(a)(2)(i)(B)

D 50. 73( a)(2)(vii)

D 73. 77(a)(2)(ii)

D 50. 73(a)(2)(i)(C)

D OTHER Specify in Abstract below or in YEAR 2016

3. LER NUMBER SEQUENTIAL NUMBER 001

C. Dates and approximate times of occurrences

Dates and Aooroximate Times June 17, 2016 at 0855 CDT June 17, 2016 at 1436 CDT June 17, 2016 at 1705 CDT June 17, 2016 at -2100 CDT June 17, 2016 at 2135 CDT June 17, 2016 at 2239 CDT June 19, 2016 at 2150 CDT June 20, 2016 at 0358 CDT June 20, 2016 at 0455 CDT June 20, 2016 at 0530 CDT D. Manufacturer and model number (or other identification) of each component that failed during the event:

The blown fuse (2-FU2-073-0039B) was manufactured by Shawmut Company under manufacturer part number ATM 10. The failed relay (2-RL Y-073-23A-K43) is an Agastat ETR type time delay relay. It was manufactured by Amerace Corporation under manufacturer part number ETR 14D3BN003.

E. Other systems or secondary functions affected

No other systems or secondary functions were affected by this event.

F. Method of discovery of each component or system failure or procedural error

During performance of the HPCI Time Delay Relay Calibration surveillance 2-SR-3.3.6.1.6(3),

Electrical Maintenance personnel received an abnormal indication of no voltage to the coil of 2-RLY-073-23A-K43 at step 7.3[17] of the procedure. Upon performing the procedure step 7.3[17], fuse BFN-2-FU2-073-0039B cleared and 2-XA-55-3F window 3, HPCI Logic Power Failure, alarmed in the Control Room.

The failed fuse was discovered during the performance of the Unit 2 HPCI Time Delay Relay Calibration 2-SR-3.3.6.1.6(3). HPCI Logic Bus B lost power when fuse 2-FU2-073-0039B cleared. During troubleshooting relay 2-RL Y-073-23A-K43 was replaced along with its base, 3500 ohm dropping resistor, and zener diode. The removed relay was bench tested and did not function properly.

G. The failure mode, mechanism, and effect of each failed component, if known:

During troubleshooting, relay 2-RL Y-073-23A-K43 was replaced along with its base, 3500 ohm dropping resistor, and zener diode. The removed relay was bench tested and did not function properly. Initial bench testing of the faulty relay was performed on June 29, 2016, and additional testing was performed on July 8, 2016, in order to determine the failure mode and mechanism.

The bench testing found that the current drawn by the electronic timer was approximately 5 mA.

The coil resistance was calculated to be 800 ohms. The specification for coil resistance on this relay is 3000 ohms. The relay failure resulted from coil failure.

Relay 2-RLY-073-23A-K43, which is normally de-energized, is installed in a mild environment in the Unit 2 Auxiliary Instrument Room and is subjected to a very low duty cycle. The relay is energized for testing only 5 times per 24 month cycle -- twice during the Logic Functional Test Procedure and three times during the Time Delay Relay Calibration. Coil failure is accelerated by stressors such as temperature and humidity, prolonged continuous energization, prolonged overvoltage, and/or high cycling rate. Relay 2-RL Y-073-23A-K43 is not routinely subjected to these significant stressors; however the effects of normal environmental stressors such as 2016 -

001 00 temperature and humidity over time are cumulative and permanent. The relay is approximately 27 years old. The degradation of the insulation results in temperature rise in the coil, which further breaks down the dielectric strength of the insulation and results in local short circuits within the coil. The drop in coil resistance from 3000 ohms to 800 ohms indicates short circuits had developed in the coil. Because of this fault, the electromagnetic strength developed by the relay coil was below the minimum needed to overcome the spring force holding the relay contacts in their shelf state.

The 2-RL Y-073-23A-K43 relay provides a 3 second time delay before closing the contacts that give an open signal to HPCI pump discharge valve 2-FCV-073-0034 and a close signal to HPCI Condensate Storage Tank (CST) test return valve 2-FCV-073-0035. The HPCI pump discharge valve 2-FCV-073-0034 is normally open, but if it were closed the relay failure would have prevented flow during HPCI actuation. The HPCI CST test return valve 2-FCV-073-0035 is normally closed. The relay failure would prevent closure of this valve from the open position.

During HPCI flow surveillance two normally closed CST return valves 2-FCV-073-0035 and 2-FCV-073-0036 are opened. If HPCI were actuated in this condition 2-FCV-073-0035 would have failed to close. The closure time for the remaining valve 2-FCV-073-0036 is not fast enough to ensure full flow to the reactor within the time specified in the accident analysis.

The review of the condition and the bench testing concluded that the relay failure was attributed to end-of-life failure caused by normal breakdown of the coil insulation over time.

H. Operator actions

There were no operator actions associated with this event.

I. Automatically and manually initiated safety system responses

There were no automatic or manual safety system responses associated with this event.

Ill.

Cause of the event

A. The cause of each component or system failure or personnel error, if known:

The most likely cause for the blown fuse on HPCI Logic Bus B was an equipment ground induced by the TM200 timer, while testing was being performed with a known ground on Battery Board 2.

During troubleshooting of the blown fuse, it was discovered that the relay was faulty as well. It was determined that the relay failure was end-of-life failure caused by normal breakdown of coil insulation over time.

B. The cause(s) and circumstances for each human performance related root cause:

None IV.

Analysis of the event

The Tennessee Valley Authority (TVA) is submitting this report in accordance with Title 10 of the Code of Federal Regulations 50. 73(a)(2)(v)(D), as an event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to mitigate the consequences of an accident. The condition was discovered on June 17, 2016, while performing HPCI Time Delay Relay Calibration surveillance 2-SR-3.3.6.1.6(3) when electrical maintenance personnel observed fuse BFN-2-FU2-073-0039B clear and 2-XA-55-3F window 3, HPCI Logic Power Failure, alarmed in the Control Room. This loss of logic power rendered Unit 2 HPCI system inoperable. Also during troubleshooting, it was discovered that relay 2-RL Y-073-23A-K43 was faulty.

This event also resulted in past HPCI system inoperablility in certain test configurations. Since HPCI is a single-train safety system, both failures are reportable events, in accordance with NUREG-1022.

V.

Assessment of Safety Consequences

This event resulted in inoperability and unavailability of the single train of the BFN, Unit 2, HPCI system resulting in the inability of the HPCI system to perform its safety function. In the event of an emergency, the Reactor Core Isolation Cooling (RCIC) system remained operable, and all other Emergency Core Cooling System (ECCS) and Automatic Depressurization Systems (ADS) were available during this even to facilitate core cooling.

Based on the discussion above, during the time period that the HPCI system was inoperarble, sufficient systems were available to provide the required safety functions to protect the health and safety of the public.

A. Availability of systems or components that could have performed the same function as the components and systems that failed during the event:

The Technical Specification Required Action and Completion Time when the HPCI system is inoperable is to verify RCIC is operable by administrative means immediately and restore HPCI operability within 14 days. The Technical Specification Required Action and Completion Time for this situation is to enter Mode 3 in 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. RCIC was verified to be operable by administrative means by Operations personnel on June 17, 2016 at 0856 CDT. During this event, all other ECCS, including the ADS, were available to mitigate abnormal and accident conditions.

B. For events that occurred when the reactor was shut down, availability of systems or components needed to shut down the reactor and maintain safe shutdown conditions, remove residual heat, control the release of radioactive material, or mitigate the consequences of an accident:

This event did not occur when the reactor was shutdown.

C. For failure that rendered a train of a safety system inoperable, an estimate of the elapsed time from discovery of the failure until the train was returned to service:

HPCI was determined to be inoperable at 1705 CDT on June 17, 2016. It was declared operable on June 20, 2016, at 0530 CDT. Approximately 2.5 days (36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> and 25 minutes) elapsed between the time of discovery and restoring operability. The safety functions supported by relay 2-RL Y-073-23A-K43 were not operable for multiple periods of time due to the faulty relay since March of 2015. All cases reviewed were within the Technical Specification required LCO times such that there were no violations of Technical Specifications.

VI.

Corrective Actions

Corrective Actions are being managed by TVA's corrective action program under Condition Report (CR) 1183196.

A. Immediate Corrective Actions

Electricians stopped work after observing unexpected response during surveillance Replaced fuse 2-FU2-073-0039B Replaced relay 2-RL Y-073-23A-K43

8. Corrective Actions to Prevent Recurrence The most likely cause of the blown fuse was an equipment ground induced by the TM200 timer used in the calibration procedure for timing pick-up of the time delay relays. The corrective action to address this cause is to revise the procedures to reconfigure the setup of the test equipment which will reduce the probability and consequences if a ground is induced by the test equipment.

It was determined that the relay 2-RL Y-073-23A-K43 was faulty as the result of end-of-life failure.

Although not causal to the blown fuse, the relay failure was caused by normal breakdown of the coil insulation over time, and it has been replaced. The investigation of this relay failure is being revised, and a supplement to this LER will be submitted at a later date.

A. Previous Similar Events

An Internal Operating Experience (OE) search was performed for the past 5 years using key terms "HPCI," "RHR," "CS," and "Agastat ETR relay(s)". The following examples were identified as similar events resulting from blown fuses that were potentially due to incorrect test equipment setup during logic test performance procedures.

CR 1180190: Fuse 2-FU2-074-10A/K36B cleared during performance of 2-SR-3.3.5.1.5(LPCI II), RHR System Division II LPCI Mode Logic Time Delay Relay 2016 -

001 00 Calibration, 6/9/2016. No problems identified by basic troubleshooting. MEG re-commenced the procedure on 6/20/2016, and the surveillance was completed satisfactorily at that time. No causal analysis was performed. The CR details noted that the same fuse was blown during the previous performance of this procedure (see below for CR 898072).

CR 898072: Blown fuse during performance of 2-SR-3.3.5.1.5(LPCI II), RHR System Division II LPCI Mode Logic Time Delay Relay Calibration, 6/13/2014. Fuse was replaced, the surveillance was completed successfully, and CR was closed to actions taken. No additional analysis was performed.

CR 1056740: Blown fuse during performance of 2-SR-3.3.5.1.6(CS II), Core Spray System Logic Functional Test Loop 11, 7/14/2015. Fuses were replaced, and CR was closed to actions taken.

B. Additional Information

There is no additional information.

C. Safety System Functional Failure Consideration:

Both of these conditions, the blown fuse due to an inadequate calibration procedure and the failed relay, resulted in the inability of the BFN, Unit 2, HPCI system to perform its safety function for safe and sustainable shutdown of the reactor, mitigation of the consequences of an accident, and removal of residual heat in the event that the reactor was shut down. In accordance with NUREG-1022, both conditions are considered Safety System Functional Failures.

D. Scram with Complications Consideration:

This event did not result in a reactor scram.

VIII. COMMITMENTS

There are no new commitments.