05000324/LER-2015-002, Regarding Emergency Diesel Generator Loss of Safety Function

Regarding Emergency Diesel Generator Loss of Safety Function

ML15149A148
Person / Time
Site:	Brunswick
Issue date:	05/20/2015
From:	William Gideon Duke Energy Progress
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
BSEP 15-0042 LER 15-002-00
Download: ML15149A148 (7)

LER-2015-002, Regarding Emergency Diesel Generator Loss of Safety Function

Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(1), Submit an LER, Invalid Actuation 10 CFR 50.73(a)(2)(i) 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability 10 CFR 50.73(a)(2)(ii)(A), Seriously Degraded 10 CFR 50.73(a)(2)(viii)(A) 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition 10 CFR 50.73(a)(2)(viii)(B) 10 CFR 50.73(a)(2)(iii) 10 CFR 50.73(a)(2) 10 CFR 50.73(a)(2)(iv)(A), System Actuation 10 CFR 50.73(a)(2)(x) 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor 10 CFR 50.73(a)(2)(v)(B), Loss of Safety Function - Remove Residual Heat 10 CFR 50.73(a)(2)(i)(A), Completion of TS Shutdown 10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications
3242015002R00 - NRC Website

text

DUKE

ENERGY, William R. Gideon Vice President Brunswick Nuclear Plant P.O. Box 10429 Southport, NC 28461 o: 910.457.3698 10 CFR 50.73 May 20, 2015 Serial: BSEP 15-0042 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001

Subject:

Brunswick Steam Electric Plant, Unit Nos. 1 and 2 Renewed Facility Operating License No. DPR-71 and DPR-62 Docket Nos. 50-325 and 50-324 Licensee Event Report 1-2015-002 In accordance with the Code of Federal Regulations, Title 10, Part 50.73, Duke Energy Progress, Inc., submits the enclosed Licensee Event Report (LER). This report fulfills the requirement of 10 CFR 50.73(a)(1) for a written report within sixty (60) days of a reportable occurrence.

Please refer any questions regarding this submittal to Mr. Lee Grzeck, Manager - Regulatory Affairs, at (910) 457-2487.

William R. Gideon SWR/swr Enclosure: Licensee Event Report 1-2015-002 Z:Isi d:::>c OV-

U.S. Nuclear Regulatory Commission Page 2 of 2 cc (with enclosure):

U. S. Nuclear Regulatory Commission, Region II ATTN: Mr. Victor M. McCree, Regional Administrator 245 Peachtree Center Ave, NE, Suite 1200 Atlanta, GA 30303-1257 U. S. Nuclear Regulatory Commission ATTN: Ms. Michelle P. Catts, NRC Senior Resident Inspector 8470 River Road Southport, NC 28461-8869 U. S. Nuclear Regulatory Commission ATTN: Mr. Andrew Hon (Mail Stop OWFN 8G9A) (Electronic Copy Only) 11555 Rockville Pike Rockville, MD 20852-2738 Chair - North Carolina Utilities Commission P.O. Box 29510 Raleigh, NC 27626-0510

NRC FORM 366 U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY OMB: NO. 3150-0104 EXPIRES: 01/31/2017 (02-2014)

(02,2014)

Estimated burden per response to comply with this mandatory collection request: 80 hours9.259259e-4 days <br />0.0222 hours <br />1.322751e-4 weeks <br />3.044e-5 months <br />.

Reported lessons learned are incorporated into the licensing process and fed back to industry.

Send comments regarding burden estimate to the FOIA, Privacy and Information Collections

(%

)

Branch (T-5 F53), U.S.

Nuclear Regulatory Commission, Washington, DC 20555-0001, or by

... LICENSEE EVENT REPR T (

intemet e-mail to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and (See Page 2 for required number of Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB digits/characters for each block) control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

3. PAGE Brunswick Steam Electric Plant (BSEP), Unit 1 05000325 1 OF 5

4. TITLE Emergency Diesel Generator Loss of Safety Function

5. EVENT DATE

6. LER NUMBER

7. REPORT DATE

8. OTHER FACILITIES INVOLVED Y SEQUENTIAL REV FACILITY NAME DOCKET NUMBER NUMBER NO MONTH DAY YEAR BSEP Unit 2 05000324 FACILITY NAME DOCKET NUMBER 03 2 052015-002

- 00 05 20 2015 05000

9. OPERATING MODE

11. THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR §: (Check all that apply)

El 20.2201(b)

El 20.2203(a)(3)(i)

El 50.73(a)(2)(i)(C)

El 50.73(a)(2)(vii)

El 20.2201(d)

El 20.2203(a)(3)(ii)

El 50.73(a)(2)(ii)(A)

El 50.73(a)(2)(viii)(A)

El 20.2203(a)(1)

El 20.2203(a)(4)

[E 50.73(a)(2)(ii)(B)

El 50.73(a)(2)(viii)(B) 20.2203(a)(2)(i)

[]1 50.36(c)(1)(i)(,A)

E] 50.73(a)(2)(iii)

[E 50.73(a)(2)( ix)(A)

10. POWER LEVEL El 20.2203(a)(2)(ii)

El 50.36(c)(1)(ii)(A)

[: 50.73(a)(2)(iv)(A)

El 50.73(a)(2)(x)

El 20.2203(a)(2)(iii)

El 50.36(c)(2)

[E 50.73(a)(2)(v)(A)

El 73.71 (a)(4)

El 20.2203(a)(2)(iv)

El 50.46(a)(3)(ii)

[: 50.73(a)(2)(v)(B)

El 73.71 (a)(5) 1E 20.2203(a)(2)(v)

El 50.73(a)(2)(i)(A)

[E 50.73(a)(2)(v)(C)

El OTHER El 20.2203(a)(2)(vi)

El 50.73(a)(2)(i)(B) 0 50.73(a)(2)(v)(D)

Specity in Abstract below or in

12. LICENSEE CONTACT FOR THIS LER LICENSEE CONTACT TELEPHONE NUMBER (Include Area Code)

Lee Grzeck, Manager - Regulatory Affairs 1[(910) 457-2487CAUSE I

SYSTEM I COMPONENT MANUI REPORTABLE

CAUSE

Y REPORTABLE C

S FACTURER TO EPIX SYSTEM COMPONENT FACTURER TO EPIX B

EK 2

A160 No 1

14. SUPPLEMENTAL REPORT EXPECTED

15. EXPECTED MONTH DAY YEAR SUBMISSION El YES (If yes, complete 15. EXPECTED SUBMISSION DATE)

[

NO DATE ABSTRACT (Limit to 1400 spaces, i.e., approximately 15 single-spaced typewritten lines)

On April 23, 2015, following an engineering evaluation, it was determined that during a period of 12 minutes from 14:05 to 14:17 Eastern Daylight Time on March 21, 2015, Emergency Diesel Generators (EDGs) 3 and 4 could potentially have been unable to tie to their respective emergency busses. This was due to relays in breaker control logic that were susceptible to electrical noise from nearby relays de-!energizing that could have prevented the output breakers from properly closing under certain conditions. This is considered a loss of safety function of the onsite standby alternating current (AC) power source. Three of four EDGs are required to mitigate an accident on one unit while maintaining the other unit in a safe condition. This condition is being reported in accordance with 10 CFR 50.73(a)(2)(v)(D) as a condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to mitigate the consequences of an accident. The cause of EDG 3 and 4 loss of safety function was electrical noise that caused relays to oscillate, preventing the EDG output breakers from remaining closed. A relay model not susceptible to noise interference was installed in EDG 4 breaker control logic on March 22, 2015. A voltage transient suppression device was installed on EDG 3 breaker control logic on March 23, 2015.

NRC FORM 366 (02-2014)

Energy Industry Identification System (EIIS) codes are identified in the text as [XX].

Background

Initial Conditions At the time of the event, Unit 1 was in Mode 1 at approximately 100 percent of rated thermal power, and Unit 2 was in Mode 5 (i.e., Refueling).

The only Unit 1 safety-related equipment out of service at the time of this event was the 1 B Residual Heat Removal System [BO] pump. This item of equipment being out of service had no effect on the sequence of events described in this report.

Reportability Criteria This cdndition is being reported in accordance with 10 CFR 50'.73(a)(2)(v)(D) as an event or condition that could have prevented the fulfillment of the safety function of a system that is needed to mitigate the consequences of an accident. The loss of safety function was discovered after the event had occurred; thus, no Event Notification (EN) was made to the NRC per the guidance of NUREG-1022, "Event Report Guidelines 10 CFR 50.72 and 50.73," Revision 3.

Event Description

During the Unit 2 refueling outage of spring 2015, emergency diesel generator 3 (EDG 3) [EK] reliability modifications were performed. These modifications included replacement of the voltage regulator and governor. The governor replacement was completed while EDG 3 was removed from service from March 10 through March 18.

During post-maintenance testing (PMT) for the governor replacement, the EDG 3 output breaker failed to remain closed in response to a simulated loss of offsite power condition. This failure was determined to have been caused by a relay, designated 2-DG3-RCR, which experienced oscillation in response to electrical noise generated by a second relay de-energizing, designated 2-DG3-RCR-X. Both relays were replaced; additional monitoring equipment was installed, and the PMT for EDG 3 was successfully completed on March 18.

Based on the behavior of relay 2-DG3-RCR, a decision was made to proactively replace the identical relays on EDG 4, designated 2-DG4-RCR and 2-DG4-RCR-X. On March 19, EDG 4 was removed from service, and during the ensuing maintenance window, the relays were replaced. During the PMT on March 21 for EDG 4, the output breaker cycled four times before remaining closed. This resulted from misoperation of the newly installed relay, 2-DG4-RCR.

A failure of the EDG output breaker to close due to erratic RCR relay operation could occur only if the affected EDG were already running and not tied to its electrical bus when a breaker closure signal is received. In this condition, it could not be assured that the EDG output breaker would remain closed. As such, the affected EDG would be considered inoperable. When an affected EDG was in the standby mode, the RCR relay issue would have no effect, so the EDG remained operable and able to perform its safety function.

On March 21, procedure OMST-DG14R, "DG-4 Loading Test," was performed as part of the PMT for EDG 4. This test starts all four EDGs. EDG 3 ran unloaded from 13:08 Eastern Daylight Time (EDT) until it was shut down at 14:38 EDT. During this 90-minute span, therefore, EDG 3 was inoperable.

Concurrently during OMST-DG14R, EDG 4 was loaded, separated from the bus, and loaded again.

During the time EDG 4 was running unloaded, it was also inoperable. For the period of 14:05 EDT until 14:17 EDT, both EDG 3 and EDG 4 were running and were unloaded. Therefore, for this 12-minute period, both EDGs 3 and 4 were considered to be inoperable.

After the failure of EDG 4 to tie to its bus, bench testing closely matching field conditions showed that relay 2-DG4-RCR oscillated due to voltage transients generated when the adjacent RCR-X relay was de-energized. The bench testing also demonstrated that installing a transient voltage suppressor (TVS) across the RCR-X relay coil eliminated the erratic behavior of the RCR relay.

The original relay 2-DG4-RCR was bench tested and found to be not susceptible to misoperation due to electrical noise.'lt was then re-installed on March 22. In addition, given Wvhat was learned during bench testing, engineers suspected that installation of test equipment on EDG 3 (i.e., data recorder and Simpson volt-ohmmeter) had had a similar effect as the TVS by absorbing the voltage transient produced by the RCR-X relay. A test was performed on EDG 3 to challenge the new RCR relay, and it showed oscillation in response to noise generated by the RCR-X relay. It was then concluded that the presence of test equipment had contributed to the successful PMT of EDG 3 on March 18. A modification to install a TVS across the RCR-X relay coil on EDG 3 was developed. The TVS modification to EDG 3 was installed and successfully tested on March 23.

This condition resulted in a brief loss of safety function for the onsite standby alternating current (AC) power source. Three of four EDGs are required to mitigate an accident on one unit while maintaining the other unit in a safe condition. With both EDGs 3 and 4 inoperable, only EDGs 1 and 2 were operable, and the ability to perform this safety function was adversely affected. The event is not reportable as a condition prohibited by the TS because in all cases, the diesels were returned to service in less than the time allowed by the required action statement.

Event Cause

The cause of the loss of safety function was that both EDG 3 and EDG 4 were simultaneously in a condition where it could not be assured that their output breakers would close to their emergency busses.

EDG 3 was in a degraded condition after the initial relay replacement because newly installed relay 2-DG3-RCR was susceptible to electrical noise generated by relay 2-DG3-RCR-X. EDG 4 was likewise in a degraded condition because relay 2-DG4-RCR was proactively replaced, and the replacement relay was susceptible to electrical noise generated by relay 2-DG4-RCR-X. The effect of the electrical noise upon the relay was to cause it to oscillate briefly when the nearby RCR-X relay actuated. Contacts from the oscillating relay then affected the logic for closing and tripping the EDG output breaker, resulting in the breaker closing and immediately tripping. Because of the location of the contacts in the breaker logic, the oscillation could affect the logic only if the EDG were already running and not tied to its bus. If the EDG were starting from standby, the relay problem would have no effect because the oscillation would settle out long before the EDG came up to speed where the breaker could tie to its bus.

Safety Assessment

There was no actual safety consequence associated with this event, and the potential safety significance of this event is minimal. As stated previously, EDG 3 and EDG 4 were susceptible to this failure mechanism only when susceptible relays were installed in the breaker logic for both diesels, and both diesels were running and not tied to their electrical busses. The duration over which both diesels and their breaker logic met these conditions was a total of 12 minutes.

Technical Specifications Bases 3.8.1, "AC Sources - Operating," states that the safety function of the electrical power system is to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to engineered safety features (ESF) systems so that the fuel, Reactor Coolant System (RCS), and containment design limits are not exceeded. Technical Specification 3.8.2, "AC Sources - Shutdown," states that the safety function of the AC sources is to ensure that the facility can be maintained in the shutdown or refueling condition for extended periods; sufficient instrumentation and control capability is available for monitoring and maintaining the Onit status, and adequate AC electrical power is provided to mitigate events postulated during shutdown, such'as an inadvertent draindown of the vessel or a fuel handling accident. The EDGs must provide power for these safety functions should a loss of offsite power (LOOP) occur.

In addition, the Updated Final Safety Analysis Report (UFSAR) states that three of the four EDGs must be available to mitigate a design basis accident on one unit and a shutdown of the other unit without off site power available.

Since only two diesels were available during the 12-minute duration of the event, reasonable assurance could not be established that the safety functions could be met on both the operating unit and the shutdown unit.

Probabilistic Risk Analysis (PRA) examined the change in risk of having EDG 3 and EDG 4 simultaneously out of service, conservatively assuming a full hour for the duration. During the event, both EDG 1 and EDG 2 were available and protected, along with the supplemental diesel and offsite electrical sources. The analysis showed the change in Core Damage Frequency (CDF) and Large Early Release Frequency (LERF) was negligible.

Corrective Actions

Any changes to the corrective actions and schedules noted below will be made in accordance with the site's corrective action program.

The following corrective actions have been completed.

A TVS device across 2-DG3-RCR-X has been installed.

Bench testing showed the older 2-DG4-RCR relay was not susceptible to oscillating due to electrical noise. Therefore, the older RCR relay was re-installed on EDG 4, and the PMT for EDG 4 was successfully completed on March 22.

The following corrective actions are planned.

An extent of condition review will be performed for Allen Bradley 700-RTC relays installed in control logic adjacent to a GE type HFA or other large coil relays that could affect the 700-RTC relay. If a TVS is not installed, a condition report will be initiated to track and drive installation.

This action is currently due May 29, 2015.

Engineering Change 99915 will be revised to install TVS devices in the logic for EDGs 1, 2, and 4. The revision is expected by July 10, 2015, and field installation will follow based on the site's work management program.

TVS devices for EDGs 1, 2, and 4 will be installed by the end of 2015.

Previous Similar Events

A review of LERs for the past three years did not identify any previous similar occurrences. A review of the site's Corrective Action Program database also did not identify any previous similar occurrences.

Commitments

No regulatory commitments are contained in this report.