05000400/LER-2015-002
| Shearon Harris Nuclear Power Plant, Unit 1 | |
| Event date: | 04-04-2015 |
|---|---|
| Report date: | 06-03-2015 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications 10 CFR 50.73(a)(2)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability |
| 4002015002R00 - NRC Website | |
Reported lessons learned are incorporated into the licensing process and fed back to industry.
Send comments regarding burden estimate to the FOIA, Privacy and Information Collections Branch (T-5 F53), U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, or by intemet e-mail to Infocollects.Resource@nrc.gov, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0104), Office of Management and Budget, Washington, DC 20503. If a means used to impose an information collection does not display a currently valid OMB control number, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.
Energy Industry Identification System (EIIS) and component codes are identified in the text as [XX].
BACKGROUND
On April 4, 2015, Harris Nuclear Plant (HNP) was shut down for a scheduled refueling outage in mode 5, at 0% power. The Operations Surveillance Test for Remote Shutdown System Operability was being performed, which involves switching control from the Main Control Board (MCB) to the Auxiliary Control Panel (ACP) and back again to verify the operability of the Remote Shutdown System Transfer Switches.
As part of this test, control of Normal Air Intake Isolation Damper 1CZ-1 [ISV] was transferred to the ACP, while control of the Normal Air Intake Isolation Damper 1CZ-2 [ISV] remained with the MCB in accordance with procedure.
There were no systems, structures, or components that were inoperable at the start of the event that contributed to the event.
This event is reportable under 10 CFR 50.73(a)(2)(vii), "any event where a single cause or condition caused at least one independent train or channel to become inoperable in multiple systems or two independent trains or channels to become inoperable in a single system designed to:"... "(D) Mitigate the consequences of an accident." This event is also reportable under 10 CFR 50.73(a)(2)(v)(D), "Any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to:"... "(D) Mitigate the consequences of an accident." This event is also reportable under 10 CFR 50.73(a)(2)(i)(B), "Any operation or condition which was prohibited by the plant's Technical Specifications.
EVENT DESCRIPTION
During the surveillance test, both isolation dampers were being opened when they received a shut signal that caused the reversal of the respective motor actuators. The supply breakers [BKR] to the normal air intake isolation dampers' motor actuators both independently tripped due to high instantaneous current from the attempted direction reversal of their respective motor actuators.
The Control Room Emergency Filtration System [VI] provides a protected environment from which occupants can control the unit following an uncontrolled release of radioactivity, hazardous chemicals, or smoke. It consists of two independent, redundant trains that recirculate and filter the air in the Control Room Envelope (CRE) and a CRE boundary that limits the inleakage of unfiltered air. The CRE boundary is a single train function that is supported by the automatic closure capability of the two isolation dampers.
The automatic closure function failed due to the breaker trips resulting from high instantaneous current.
In addition to the event on April 4, 2015, there were previous instances following the installation of these breakers in January 2015 during which the dampers were stroked simultaneously during operation while the plant was at 100% power level. The period of potential vulnerability during the simultaneous opening of the dampers effectively made the CRE boundary inoperable. As such, the HNP Technical Specification Limiting Condition of Operation 3.7.6.a.2.a. action to immediately initiate mitigating actions that is applicable in modes 1, 2, 3, and 4 would not have been met since operators were not aware of the condition until April 4, 2015.
The Normal Filtration Train Air Handler AH-15A [AHU] was in service and running, while the Normal Filtration Train Air Handler AH-15B [AHU] was secured. Both 1CZ-1 and 1CZ-2 went shut during the transfer to the ACP. During the transfer from the ACP back to the MCB, power was interrupted to the transfer relay [RLY], causing the relay to reset and send an open signal to 1CZ-1. This loss of power also caused AH-15A to trip offline. With AH-15A and AH-15B offline, 1CZ-1 received a signal to close while in the process of stroking open. 1CZ-2 did not receive an open signal because it was still controlled per the MCB. Both dampers received a shut signal.
Once 1CZ-1 was in the fully open position, 1CZ-1 started to reverse direction and the reversal in direction of the damper motor actuator caused the breaker supplying the motor actuator to 1CZ-1, 1A36-SA-4B [BKR], to trip due to high instantaneous current, resulting in a loss of power to the damper motor actuator.
As a result, 1CZ-1 remained partially open while 1CZ-2 remained closed.
The operator took action to restore the Main Control Room Heating, Ventilating, and Air Conditioning (HVAC) System [VI] to its normal configuration. This included taking an action to open 1CZ-2 from the MCB switch. 1CZ-2 went full open, but then began to cycle closed due to the shut signal from both air handlers being offline. This reversal in direction of the damper motor actuator resulted in a high instantaneous current that tripped breaker 1636-SB-4A [BKR] and resulted in 1CZ-2 being partially open.
With both breakers tripped and both dampers partially open, a failure of the associated CRE boundary automatic safety function occurred. Operators used the hand wheels associated with 1CZ-1 and 1CZ-2 to shut the dampers to restore integrity of the CRE boundary. AH-15A was restarted and the breaker function was restored. There was neither movement of irradiated fuel nor movement of loads over the spent fuel pool during the performance of Operations Surveillance Test for Remote Shutdown System Operability.
These actions were consistent with HNP's Technical Specifications.
CAUSAL FACTORS
The apparent cause of the unintended breaker trips is that the HMCP model breaker/starter combination installed by a Design Change is more sensitive to peak current spikes than the original EF3 model breakers. This Design Change is part of an on-going project that replaces Motor Control Center (MCC) components to address obsolescence. The breaker instantaneous trip set points were set too low to prevent unintended trips. There is no record of unintended 1CZ-1 and 1CZ-2 trips while using the previous EF3 breakers and there is extensive industry operating experience (OE) that demonstrates the behavior of the HMCP model breakers identified at HNP is consistent with the behavior witnessed by the rest of the industry in some applications.
The contributing cause associated with this event is that previous industry OE was not effectively used to prevent problems. The OE associated with the installation of the HMCP model breakers was not adequately reviewed to identify existing OE on the need to raise the trip setting on HMCP model breakers above the standard value typically used for this breaker type.
SAFETY ANALYSIS
There were no safety consequences associated with this event.
NUREG-1038, "HNP Safety Evaluation Report related to the operation of Shearon Harris Nuclear Power Plant," Section 6.4, "Control Room Habitability," states "The control room will be isolated by the closure of the isolation dampers - on receipt of a containment isolation actuation signal or following detection at the outside air intake of significant quantities of radiation." The automatic closure of the isolation dampers would not have occurred as a result of the condition identified on April 4, 2015.
During the April 4, 2015 event, HNP was in mode 5, there was no movement of irradiated fuel assemblies, and no loads were moved over the spent fuel pool. There were also no safety injection actuation signals, no high radiation signals from the radiation monitors located within each air intake, and no smoke signals at the normal outside air intake. As such, no Control Room isolation signals were generated that would require the isolation dampers to be closed. Direct operator action was taken to manually shut both isolation dampers using the installed declutch levers and hand wheels, preserving the fulfillment of the safety function of the Control Room Emergency Filtration System.
If an accident occurred and the dampers did not fully close during any plant mode, Operations would recognize this condition immediately and operator action to manually shut both isolation dampers using the installed declutch lever and hand wheels would have effectively fulfilled the safety function of the Control Room Emergency Filtration System.
CORRECTIVE ACTIONS
Completed Actions
1) The trip setting for breakers 1A36-SA-4B and 1B36-SB-4A were revised by work order implementation for isolation dampers 1CZ-1 and 1CZ-2 to add margin to the trip settings.
2) Per the Extent of Condition, the new trip setting criteria has been applied to the remainder of the impacted HMCP model breakers installed in the Design Change Package.
3) The calculation for MCC Overcurrent Protective Device Selection/Setting was revised to ensure future MCC installations occur with the HMCP model breakers set to the higher trip setting.
Planned Actions
1) Present a Tailgate topic covering lessons learned from this event. Specifically, emphasize the need to review OE for thoroughness and completeness when performing a Design Verification/Owner's Review of a vendor Design Change product.
2) Discuss this event as OE during the Operations and Training Focus session for Session 15-03.
Include an emphasis on the need to obtain additional input when a condition is identified, which potentially impacts the site's compliance with Technical Specifications.
3) Communicate this event to all shifts. Specifically, emphasize the need to obtain additional input when a condition is identified, which potentially impacts the site's compliance with Technical Specifications.
PREVIOUS EVENTS
There have been no related reportable events at HNP. HNP became aware of the issue on April 4, 2015.
COMMITMENTS
This report contains no regulatory commitments.