05000400/LER-2012-003
| Shearon Harris Nuclear Power Plant, Unit 1 | |
| Event date: | |
|---|---|
| Report date: | |
| 4002012003R01 - NRC Website | |
Event Description
At 10:18 EDT on October 26, 2012, at 100% power in Mode 1, during the monthly equipment swaps, primary shield fan S-2B-SB [FAN] failed to remain secured after engaging the main control board (MCB) hand switch. An attempt to secure the fan was completed two times. Each time, the S-2B-SB fan stopped when the control switch was taken to stop, but the fan restarted when the switch was returned to normal. If operating per design, the fan would remain off when the switch was returned to normal. Shift personnel evaluated the condition and determined that the most likely cause of the failure was the 42 relay contact [CNTR] sticking shut. The condition caused the “B” emergency diesel generator (EDG) to be inoperable, but licensed operators and other station personnel did not recognize the impact on operability.
Several days later, NRC resident inspectors questioned plant staff regarding the impact of the primary shield fan failure to secure on EDG operability. On October 31, 2012 at 15:26, breaker 1B21-SB-4B (S-2B-SB) [BKR] was opened which returned “B” EDG to operable status. The “B” EDG was inoperable for approximately 125 hours0.00145 days <br />0.0347 hours <br />2.066799e-4 weeks <br />4.75625e-5 months <br />.
By design, upon a loss of offsite power, the “B” primary shield fan would be shed from its normal power supply, the “B” EDG would automatically start, the EDG output breaker would close and energize permanently connected loads, and then the primary shield fan would be energized as an auto-connected load through the load sequencer at load block 6. With the 42 relay contact stuck shut, the “B” primary shield fan would be energized upon closure of the “B” EDG output breaker with the permanently connected loads, and then redundantly energized through the sequencer at load block 6. The fan is a small load, and starting upon closure of the output breaker did not impact the availability of the EDG.
Technical Specification 3.8.1.1, Surveillance Requirement 4.8.1.1.2.f.4.b, requires each EDG be demonstrated operable by verifying that auto-connected shutdown loads are energized through the load sequencer. With the 42 relay contact stuck shut, the “B” primary shield fan would be energized upon closure of the “B” EDG output breaker with the permanently connected loads, and then be redundantly energized through the load sequencer at load block 6. Because the primary shield fan would be energized with the auto-connected loads prior to being redundantly energized through the sequencer, operation was not consistent with design and Surveillance Requirement 4.8.1.1.2.f.4.b was not satisfied, resulting in the “B” EDG being inoperable. As a result of not recognizing the impact on operability, the Limiting Condition for Operation (LCO) Required Actions of restoring the inoperable EDG to operable status or being in hot standby within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> were not taken. The breaker to the “B” primary shield fan was opened at 15:26 on October 31, 2012, which restored the “B” EDG to operable status.
The primary shield fan starting upon closure of the EDG output breaker had no significant adverse impact on the ability of the EDG to perform its safety function. The primary shield fan is a small load, and the EDG loading capability had sufficient margin to accept the small load upon closure of the output breaker.
Between 10:18 EDT on October 26, 2012 and 15:26 on October 31, 2012, with the “B” EDG available but not recognized as inoperable, planned maintenance activities on “A” train systems resulted in inoperability at the same time redundant “B” EDG was inoperable. The “A” EDG was successfully started and run on November 1, 2012, which demonstrated the opposite train EDG was available and operable during the period when “B” EDG was inoperable except for those periods when out of service for planned maintenance.
On November 1, 2012, the 42 seal-in contact was replaced for 1B21-SB-4B cubicle feeding the S- 2B-SB Primary Shield Fan. The S-2B-SB fan was successfully started and secured from the MCB hand switch for post maintenance testing.
A reportability evaluation concluded on December 6, 2012, that the condition of the inability of the primary shield fan to trip as designed caused the “B” EDG to be inoperable (time of discovery).
The root cause evaluation, Condition Report (CR) 569593, identified a similar unrecognized impact on EDG operability of another load that would not secure from the MCB. On September 27, 2010 at 03:09, the “B” Component Cooling Water (CCW) pump lost indication of pump running status.
Operators correctly identified that the “B” CCW pump and sequencer were inoperable. The condition also caused Surveillance Requirement 4.8.1.1.2.f.4.b to be not satisfied, resulting in the EDG being inoperable. However, licensed operators and other station personnel did not recognize the impact on operability of the EDG. In this case, the “B” EDG was inoperable for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> and 19 minutes, which was consistent with the Required Action to restore the inoperable EDG to operable status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, but other administrative Required Actions were not taken.
Cause of Event
The cause of the failure of the fan to remain secured was age-related failure of the 42 seal in contact in Motor Control Center 1B21-SB-4B (Manufacturer: Telemecanique, Model No.: HE3-B100). The root cause of the failure to recognize the impact of the contact failure on the “B” EDG operability was that the Technical Specification Bases do not provide adequate clarity regarding Surveillance Requirement applicability and the specific requirements associated with EDG Operability. Due to this lack of guidance within the Technical Specification Bases regarding the applicability of Surveillance Requirements, plant staff has incorrectly interpreted Surveillance Requirement 4.8.1.1.2.f.4.b.
Contributing causes include Operations Technical Specification training does not include adequate instruction and Operations procedures do not tie fan S-2B-SB to EDG operability.
There was minimal safety significance to this event. The Harris EDGs are capable of starting a 1300 horsepower load at any point of load sequencing including the last load to sequence, with the resulting steady-state load being equal to the Emergency Diesel Generator rating. The Primary Shield Fan is rated at 40 horsepower and well within the design capability of the EDG. Based on the loading margin for the EDG, there is no impact to the ability for the EDG to provide power to the engineered safety feature loads, so the function was available. However, the Primary Shield Fan (S- 2B-SB) would not have been initially energized through the load sequencer and therefore would not satisfy Technical Specification Surveillance Requirement 4.8.1.1.2, resulting in LCO 3.8.1.2 being not met and the “B” EDG being inoperable, but available. Because the EDG inoperability was not recognized by operators, the Required Actions, including restore the inoperable EDG to operable status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or be in hot standby within the next six hours were not taken. Other administrative actions not taken as required by Technical Specifications were verification of offsite power within one hour and confirming no common cause impact on the other EDG within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.
The “A” EDG was successfully started and run on November 1, 2012, which demonstrated the opposite train EDG was available and operable during the period when “B” EDG was inoperable except for those periods when out of service for planned maintenance.
As described above, there were periods of time with the “B” EDG inoperable but available when “A” train equipment was also inoperable. This was reviewed for reportability as an event or condition that could have prevented fulfillment of a safety function in accordance with NUREG-1022, Revision 2.
NUREG-1022, Rev. 2 states that the level of judgment for reporting an event or condition is a reasonable expectation of preventing fulfillment of the safety function, and the intent is to capture those events where there would have been a failure of a safety system to properly complete a safety function. As described above, the “B” EDG and onsite power system were available and capable of fulfilling the safety function with a minor reduction in margin, and therefore the event is not reportable under this criterion.
As described above, the extent of condition review identified a condition in 2010 where the “B” EDG was also inoperable but not recognized as such. In that condition also, required administrative actions were not taken which meet criteria for reporting as a condition prohibited by Technical Specifications. In this case, the “B” EDG was inoperable for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> and 19 minutes, which was consistent with the Required Action to restore the inoperable EDG to operable status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, but other administrative Required Actions were not taken. Because the inoperable EDG was restored to operable status within the allowed 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, there was no significant safety impact.
Corrective Actions
Completed Corrective Actions
The 42 seal-in contact was replaced and the S-2B-SB fan tested satisfactorily.
Technical Specification Bases were revised to clarify proper sequencing and load shedding as operability requirements for EDGs and the impact of surveillance requirements on operability.
Plant procedures have been revised to include requirements to apply T/S actions for the specified train EDG associated with the Sequencer being declared inoperable.
Planned Corrective Actions
Provide additional training to operations and regulatory affairs staff related to Technical Specifications
Previous Similar Events
The root cause evaluation review of previous events was performed and found similar issues with TS misinterpretations. Some issues with Technical Specification misinterpretations were identified and the consistent cause has been a lack of clarity in the Technical Specification requirement. The prominent corrective action that was used to correct this issue has been training or providing clarity of the TS requirement. The conclusion of the review was that this is not a generic or recurring problem.
Commitments This report contains no regulatory commitments.