05000296/LER-2015-004

LER-2015-004, High Pressure Coolant Injection System Inoperable Due To Failed Pressure Switch

Event date:	05-12-2015
Report date:	07-13-2015
2962015004R00 - NRC Website

I. Plant Operating Conditions Before the Event

At the time of discovery, Browns Ferry Nuclear Plant (BFN) Unit 3 was operating in Mode 1 at approximately 100 percent rated thermal power. BFN Units 1 and 2 were unaffected by this event.

II. Description of Events

A. Event:

On May 12, 2015, at approximately 0034 Central Daylight Time (CDT) , BFN maintenance personnel commenced a scheduled High Pressure Coolant Injection (HPCl)[BJ] Steam Line Supply Low Pressure Functional Test, 3-SR-3.3.6.1.2(3B), on the BFN Unit 3 HPCI system. This Surveillance Requirement (SR) requires closing Pressure Switch (PS)[PS] 3-PS-073-0001 B, which is in the logic circuit for automatic low-pressure induced closure of HPCI isolation valves [ISV].

At 0104 CDT, the BFN Unit 3 HPCI system received a momentary Primary Containment Isolation System (PCIS) Group 4 automatic isolation. Operations observed both PCIS Group 4 'A' and 'B' initiation lights momentarily illuminate. HPCI Steam Line Inboard Isolation Valve 3-FCV-073-0002 and HPCI Steam Line Outboard Isolation Valve 3-FCV-073-0003 automatically closed. Operations personnel entered Abnormal Operating Instruction 3-AOl-064-00028, Group 4 High Pressure Coolant Injection Isolation, and declared Unit 3 HPCI inoperable and unavailable. The PCIS Group 4 Isolation was subsequently determined to be caused by a deficiency on 3-PS-073-0001 A or 3-PS-073-0001 C which allowed the circuit to complete while 3-PS-073-0001 B was taken closed for testing .

In response to HPCI system inoperability, BFN, Unit 3, entered Technical Specifications (TS) Limiting Conditions for Operation (LCO) 3.5.1, Emergency Core Cooling Systems (ECCS) - Operating , which requires each ECCS injection/spray subsystem and the Automatic Depressurization System (ADS)[SB] function of six safety/relief valves to be operable in reactor Modes 1, 2, and 3 except when HPCI and ADS valves are not required to be operable with reactor steam dome pressure less than or equal to 150 pounds per square inch, gauge (psig). Condition C was entered due to HPCI inoperability, with required actions to immediately verify Reactor Core Isolation Cooling (RCIC) operable by administrative means and restore HPCI to operable status within 14 days. RCIC was verified operable by Operations personnel.

At 0117 CDT, Operations personnel verified isolation conditions were clear and exited the 3-AOl-064-0002B. At 0125 CDT, Operations personnel declared HPCI operable and available and exited TS LCO 3.5.1 Condition C.

8. Status of structures, components, or systems that were inoperable at the start of the event and that contributed to the event:

No inoperable systems, structures, or components (SSCs) contributed to this event.

C. Dates and approximate times of occurrences:

May 12, 2015, at 0034 CDT May 12, 2015, at 0104 CDT May 12, 2015, at 0117 CDT May 12, 2015, at 0125 CDT BFN, Unit 3, commenced HPCI System Steam Supply Pressure Low Functional Test.

BFN, Unit 3, HPCI received an auto isolation signal. Isolation Valves closed automatically. Operations personnel entered 3-AOl-064-0002B for HPCI isolation.

Operations personnel declared Unit 3 HPCI inoperable and unavailable. Entered TS LCO 3.5.1 Condition C and verified RCIC operable.

Operations personnel verified isolation conditions clear and exited 3-AOl-064-0002B.

Operations personnel returned HPCI to standby readiness in accordance with operating instructions.

Operations personnel declared HPCI operable and available, and exited TS LCO 3.5.1 Condition C.

D. Manufacturer and model number (or other identification) of each component that failed during the event:

Two PSs were identified as potential points of failure . Both were manufactured by SOR Inc. The manufacturer part numbers are 5N6-B3-U8-C1A-JJTTNQ and 5N6-B3-U8-Q 1 A-JJTTNQ.

E. Other systems or secondary functions affected:

There were no other systems or secondary systems affected .

F. Method of discovery of each component or system failure or procedural error:

Operations personnel discovered the HPCI system isolation by the inadvertent closures of isolation valves 3-FCV-073-0002 and 3-FCV-073-0003 upon receiving a momentary PCIS Group 4 automatic isolation . The pressure switches in the HPCI isolation logic were determined to be the cause of this event. The valves are closed by two pairs of PS which complete a circuit: 3-PS-073-0001A and 3-PS-073-0001 C comprise one pair; 3-PS-073-0001 B and 3-PS-073-0001 D comprise the other. The valves automatically close when at least one switch from each pair is closed.

3-PS-073-0001 B was closed for maintenance. Therefore, either 3-PS-073-0001A or 3-PS-073-0001 C must have failed closed in order for the valves to close.

G. The failure mode, mechanism, and effect of each failed component, if known:

The cause for the inadvertent closures of isolation valves 3-FCV-073-0002 and 3-FCV-073-0003 was closure of 3-PS-073-0001A or 3-PS-073-0001 C due to a spurious actuation of one or both of these switches.

H. Operator actions:

Upon receipt of the BFN, Unit 3, PCIS Group 4 Isolation:

• Entered abnormal operating instruction 3-AOl-064-00028 for HPCI isolation.

• Declared BFN, Unit 3, HPCI inoperable and unavailable.

• Entered TS LCO 3.5.1 Condition C.

• Verified RCIC operable.

Upon completing actions required by 3-AOl-064-00028:

• Verified isolation conditions clear and exited 3-AOl-064-00028.

• Returned HPCI to standby readiness in accordance with operating instruction 3-01-073, High Pressure Coolant Injection System.

• Declared HPCI operable and available.

• Exited TS LCO 3.5.1 Condition C.

I. Automatically and manually initiated safety system responses:

During this event, a spurious actuation of a PS resulted in a PCIS Group 4 isolation of the HPCI system.

Ill. Cause of the event A. The cause of each component or system failure or personnel error, if known:

The apparent cause of this event was a deficiency on 3-PS-073-0001A or 3-PS-073-0001 C, which allowed the circuit to complete while 3-PS-073-0001 B was taken closed for testing . Investigation and troubleshooting cou ld not identify a specific defect.

B. The cause(s) and circumstances for each human performance related root cause:

In-depth reviews of procedure 3-SR-3.3.6.1 .2(38) and the applicable work package found no incorrect steps in either document. Interviews of personnel who performed the surveillance found no evidence that the procedure and work package were followed incorrectly. System design was sufficient to prevent single points of failu re, and had demonstrated excellent performance over the previous ten years . Finally, there was no operating experience that would have prevented this failure .

In conclusion , there were no human performance errors associated with this event.

IV. Analysis of the event:

The Tennessee Valley Authority (TVA) is submitting this report in accordance with Title 10 of the Code of Federal Regulations (1 O CFR) 50.73(a)(2)(v)(A), (B) , and (D) , as any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to shut down the reactor and maintain it in a safe shutdown condition , remove residual heat, or mitigate the consequences of an accident.

This event was the result of a PCIS Group 4 Isolation which caused HPCI to be inoperable. In order for the event to occur, a complete circuit must be present in the electrical path leading to the closing signal coil for valves 3-FCV-073-0002 and 3-FCV-073-0003. The circuit uses one-out-of-two-taken-twice logic, and is completed if at least one PS out of each of two sets (comprised of two PSs in parallel) is closed . The PS closes upon sensing pressure below its setpoint, when manually operated , or when the switch fai ls. A single switch failure cannot result in isolation of the HPCI system.

One set (BID) contains 3-PS-073-0001 B, which was closed during the event for testing , and 3-PS-073-0001 D. The other set (A/C) contains 3-PS-073-0001 A and 3-PS-073-0001 C. One of the switches in the A/C path is believed to have spuriously actuated and failed closed during the event, completing the circuit and energizing the HPCI isolation valves' closing mechanisms.

The ci rcuit logic for the closing mechanisms of these valves prevents automatic closure of the valves resulting from a single failure of any PS in the circuit. During the performance of 3-SR-3.3.6.1.2(3B) a switch in the B/D path was closed for testing , coinciding with the failure of a switch in the A/C path . The circuit's inherent resistance to single-switch failures , combined with the intermittent nature of the fault , caused the problem in the A/C path to remain undetected for an indeterminate length of time.

The safety function of HPCI is to assure that the reactor is adequately cooled to limit fuel cladding temperature in the event of a small break in the nuclear system and loss of coolant which does not result in rapid depressurization of the reactor vessel. Due to the isolation of the HPCI system, this system was unable to perform its safety function .

V. Assessment of Safety Consequences

This event resulted in inoperability and unavailability of the single train of the BFN , Unit 3, HPCI system resulting in the inability of the HPCI system to perform its safety functions for shutting down the reactor and maintaining it in a safe shutdown condition , mitigation of the consequences of an accident, and the removal of residual heat in the event that the reactor was shut down. In the event of an emergency, the RCIC system remained operable, and all other ECCS and ADS systems were available during this event to facilitate core cooling . Therefore, during the time period that the HPCI system was inoperable, sufficient systems were available to provide the required safety functions to protect the health and safety of the public.

A. Availability of systems or components that could have performed the same function as the components and systems that failed during the event:

During this event, RCIC was verified as operable by Operations personnel.

Additionally, all other ECCS and ADS systems remained operable.

B. For events that occurred when the reactor was shut down, availability of systems or components needed to shut down the reactor and maintain safe shutdown conditions, remove residual heat, control the release of radioactive material, or mitigate the consequences of an accident:

This event did not occur when the reactor was shut down.

C. For failure that rendered a train of a safety system inoperable, an estimate of the elapsed time from discovery of the failure until the train was returned to service:

The event resulted in inoperability of the BFN, Unit 3, HPCI system for approximately twenty-one minutes from 0104 CDT on May 12, 2015, when the system was isolated, until 0125 CDT on May 12, 2015, when the HPCI was returned to standby readiness.

VI. Corrective Actions:

Corrective actions are being managed by TV A's Corrective Action Program (CAP) under Condition Report (CR) 1024825. The following corrective actions are in progress:

1. Installation of a Yokogawa recorder across JJ-13 and JJ-14 immediately prior to next performance of 3-SR-3.3.6.1.2(38), HPCI Steam Supply Low Pressure Functional Test, in order to troubleshoot PSs.

2. Replacement of 3-PS-073-0001A and C.

3. Implementation of a strategy for mitigation of HPCI isolation risk during performance of 3-SR-3.3.6.1.2(38) There is no Operating Experience or maintenance trend to suggest that this component is generally unreliable and should be replaced on other systems.

VII. Additional Information:

A . Previous Similar Events:

A review of the BFN CAP and Licensee Event Reports (LE Rs) for Units 1, 2, and 3 revealed no PS failures in BFN HPCI systems for the last five years.

A search of BFN Licensee Event Reports (LERs) for Units 1, 2, and 3 for the last five years identified four events involving HPCI system isolation during testing ; however, none of the underlying causes for the isolations were similar to this event.

B. Additional Information:

There is no additional information.

C. Safety System Functional Failure Consideration:

This event resulted in the inability of the BFN, Unit 3, HPCI system to perform its safety functions for safe and sustainable shutdown of the reactor, mitigation of the consequences of an accident, and removal of residual heat in the event that the reactor was shut down. In accordance with NUREG-1022, this event is considered a safety system functional failure.

D. Scram with Complications Consideration :

This event did not result in a reactor scram.

VIII. COMMITMENTS

There are no new commitments.