05000318/LER-2014-002

LER-2014-002, Diesel Generator Technical Specification Surveillance Requirement Missed Due to Human Performance Error

Calvert Cliffs Nuclear Power Plant, Unit 2
Event date:	06-09-2014
Report date:	08-07-2014
3182014002R00 - NRC Website

A. INITIAL CONDITIONS:

Unit 2 was operating in Mode 1 on June 11, 2014 prior to the event.

B. EVENT:

On June 9, 2014 at 1735, the 2A Diesel Generator (DG) field flash monitoring relay alarmed in the Control Room. The Control Room licensed operator dispatched the outside operator to determine the cause of the alarm. Local investigation revealed no alarms and no conditions or parameters consistent with an alarm condition. The outside operator checked the Alarm Response Manual and notified the Control Room Supervisor (CRS) and Shift Manager of an action in the alarm manual which required Operations staff to contact electrical maintenance.

During shift turnover to the nightshift Operations crew, the Alarm Response Manual action to contact electrical maintenance was delayed pending an investigation by Operations personnel.

The Operations crew conducted a detailed investigation and concluded that the issue was most likely an alarm card that did not impact the DG's operability. Based on this conclusion, it was determined by the Operations crew that Electrical Maintenance did not need to be immediately contacted to begin troubleshooting. The oncoming dayshift Operations crew contacted the Electrical Maintenance department and troubleshooting of the circuit began on June 10, 2014.

On June 11, 2014 at 1035, it was determined by the Electrical Maintenance technicians that the alarm was caused by a loose fuse clip, which made the 2A DG inoperable due to the inability to flash the generator field. The fuse clip was adjusted and the 2A DG was tested to re-establish operability on June 11, 2014 at 1632.

TO THE EVENT:

There were no structures, components, or systems inoperable at the start of the event that contributed to the event.

D. DATES AND APPROXIMATE TIMES OF MAJOR OCCURRENCES:

June 9, 2014, 1735: An unexpected alarm (1C20A AA01) for the 2A DG was received in the control room.

June 9, 2014, 1830: Operations crew conducted the shift turnover meeting. It was determined to delay contacting Electrical Maintenance pending Operations investigation of the alarm.

June 9, 2014, 1915: The Operations Work Coordinator (OWC) investigated the alarm, performs intrusive panel inspections, references prints, verifies relays to be in their proper state, diesel and auxiliaries are walked down and found to be satisfactory. Findings were reported to the CRS.

June 9, 2014, 2126: The CRS determined the 2A DG to be operable. The Shift Manager agreed with the determination. Electrical Maintenance is not contacted until morning since the belief was that the issue is related to alarm circuit based on investigation.

June 10, 2014, 0830: Troubleshooting by Electrical Maintenance technicians began and concluded that there were no issues present in the annunciation circuitry in the Control Room.

June 10, 2014, 1100: The control fuse relays were inspected. It was found that the 2A DG alarm would clear by opening the affected cabinet door containing the control power fuses and alarm relays in the 2A DG room.

June 10, 2014, 1130-1500: A troubleshooting plan was developed to determine the cause of the alarm issue and the troubleshooting plan was implemented.

June 11, 2014, 0930: The system engineer reviewed the schematic prints and notified the OWC and the Shift Manager that the source of the alarm could be caused by a condition which renders the 2A DG inoperable.

June 11, 2014,1022: Operations declares the 2A DG inoperable and enters Technical Specification (TS) Condition 3.8.1.B while further troubleshooting is performed. The troubleshooting was focused on CF-5 (field flash and alarm circuit) and CF-6 (control power).

The inoperability of the 2A DG was confirmed due to the likely inability of the 2A DG to flash its field during a start demand.

June 11, 2014, 1035: Electrical Maintenance personnel notified the Control Room Operators that the F5 fuse clip was loose, thus the diesel would not flash its field, verifying that the 2A DG was inoperable and that the condition would cause an alarm in the Control Room with no local alarms present.

June 11, 2014, 1408: Troubleshooting and repair of the F-5 fuse clip was completed satisfactorily.

June 11, 2014, 1632: A one hour loaded run of the 2A DG was completed. Operations declared the 2A DG operable and exited TS Required Action 3.8.1.8.

E. FAILURE MODES:

The significance of the event was that the 2A DG was inoperable as a result of the loose F-5 fuse clip and was unable to perform its design function of automatic starting and loading on to 21 4 kV Bus (the loose F-5 fuse clip would prevent flashing of the generator field). The involved Operations crews did not aggressively pursue the anomalous alarm to identify the cause, missing an opportunity to determine the true status of 2A DG operability earlier than June 11, 2014.

The 2A DG alarm for loss of control power came in on June 9, 2014 at 1735. The field flash fuse clip for fuse F5 was found to be loose during troubleshooting on June 11, 2014. The cause of the loose fuse clip was determined to be inadequate installation of the fuse. The loose fuse clip would have prevented flashing of the generator field and automatically starting.

No additional systems or secondary functions were affected.

The Control Room alarm identifying the probable time of DG failure occurred on June 9, 2014 at 1735. The 2A DG was restored to service on June 11, 2014 at 1632. This results in an inoperability time of 46 hours5.324074e-4 days <br />0.0128 hours <br />7.60582e-5 weeks <br />1.7503e-5 months <br /> and 57 minutes.

F. METHOD OF DISCOVERY:

During troubleshooting, the control fuse relays were inspected and it was found that the 2A DG alarm cleared by opening the affected cabinet door containing the control power fuses and alarm relays in the 2A DG room. Further troubleshooting determined that the F5 fuse clip was loose and the DG would not flash its field, verifying that the 2A DG was inoperable and that the condition would cause an alarm with no local alarms present.

II. CAUSE OF EVENT:

When faced with an unknown condition of the 2A DG (alarm present in the Control Room with no local alarms), the Operations staff reasoned that the most likely cause was an annunciation problem. The Operations staff incorrectly determined that the 2A DG was operable based on the indications available and the results of the Operations crew investigation without recognizing the consequences of the unknown cause of the alarm. This is the apparent cause of the event.

Contributing to the event, the Alarm Response Manual guidance was not strict enough to ensure a clear understanding of the impact to DG operability.

A. SAFETY CONSEQUENCES:

There were no automatic or manually initiated safety system responses.

The DGs provide onsite electrical power to safety-related plant systems in the event that offsite electrical power is interrupted. Calvert Cliffs Unit 2 has two safety-related DGs, 2A and 2B.

Calvert Cliffs also has a non-safety-related DG that can be manually aligned to either of the Unit 2 safety-related 4 kV busses that are served by the 2A and 2B DGs.

This event did not result in any actual nuclear safety consequences. The potential consequence was to have a DG inoperable without recognizing it during a design basis event with a loss of offsite power. This event was reviewed for potential probabilistic risk assessment impact. The Nuclear Regulatory Commission (NRC) Inspection Manual 0609 identifies that a GREEN (very low safety significance) is quantitatively less than 1E-6 change in core damage frequency or 1E-7 change in large early release frequency. This issue would be GREEN using the NRC's Significance Determination Process.

If an event had occurred for which the DGs would have been required, the safety function of the DGs would have been performed. In addition to the 2A DG, there is an equivalent safety- related DG (2B) which could have fully performed the safety function.

As noted above, the inoperability time for the 2A DG is 46 hours5.324074e-4 days <br />0.0128 hours <br />7.60582e-5 weeks <br />1.7503e-5 months <br />, 57 minutes. Technical Specification Condition 3.8.1.6 applies if a required DG is inoperable. Technical Specification 3.8.1.6 has two Required Actions that must be performed within an hour, one Required Action that must be performed in 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> and one Required Action that must be performed within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. These Required Actions were not performed within their Completion Times. Since these Required Actions were not performed within their Completion Times, TS Condition 3.8.1.J should have been entered. It requires that the Unit be placed in Mode 3 in 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and Mode 5 in 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> from entry into the Condition. Unit 2 was not placed in Mode 3 in 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br />, nor Mode 5 within 37 hours4.282407e-4 days <br />0.0103 hours <br />6.117725e-5 weeks <br />1.40785e-5 months <br /> from the time the 2A DG became inoperable. Therefore, the condition existed for a time longer than allowed by TSs.

B. CORRECTIVE ACTIONS:

1. Conduct training on operability/reportability calls during Licensed Operator Initial and Requalification training, specific to understanding the causes of the degraded condition and validation of indications for potential inoperability. Also include an assessment to evaluate licensed operators on the performance of operability/reportability calls.

2. Implement change to 01-49 (Operability Verification) to include guidance for Control Room personnel to determine status of Fairbanks Morse DGs alarms.

This guidance is in the outside operator portion of the checklist, but only checks local alarms.

3. Implement change to 2A DG Alarm annunciator window (AA01 @ 1C20A) or other Fairbanks Morse DG annunciator windows that do not specifically identify that a loss of control power could affect DG operability. Clarify when to declare the affected DG out-of-service until validated or repaired, as well as priority 1 maintenance.

C. PREVIOUS SIMILAR EVENTS:

There are no previous similar events.

COMPONENT

Generator, Diesel (2A) Fuse IEEE 803 IEEE 805

FU EK

The 2A DG is manufactured by Fairbanks Morse.