ML18036A265

LER 91-003-01:on 910412,unplanned ESF Occurred When Edg'S Unexpectedly auto-started.Caused by Personnel Error.Maint Personnel Will Receive Training on Proper Installation of boots.W/910625 Ltr

ML18036A265
Person / Time
Site:	Browns Ferry
Issue date:	06/25/1991
From:	Jay Wallace, Zeringue O TENNESSEE VALLEY AUTHORITY
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
LER-91-003, LER-91-3, NUDOCS 9107020148
Download: ML18036A265 (16)

Text

REGULATORY INFORMATION DISTRIBUTION SYSTEM (RIDS)

ACCESSION NBR:9107020148 DOC.DATE: 91/06/25 NOTARIZED- NO DOCKET FACIL:50-296 Browns Ferry Nuclear Power Station, Unit 3, Tennessee 05000296 AUTH. NAME AUTHOR AFFILIATION WALLACE,J.E. Tennessee Valley Authority ZERINGUE,O.J. Tennessee Valley Authority RECIP.NAME RECIPIENT AFFILIATION R

SUBJECT:

LER 91-003-01:on 910412,unplanned ESF occurred when EDG's unexpectedly auto-started. Caused by personnel error.

Maintenance personnel install boots will receive training on D proper installation of boots.W/910625 ltr.

DISTRIBDTION CODE: IE22T COPIES RECEIVED:LTR TITLE: 50.73/50.9 Licensee Event Report (LER),

NOTES I ENCL I SIZE:

Incident Rpt, etc.

RECIPIENT COPIES RECIPIENT COPIES D ID CODE/NAME LTTR ENCL ID CODE/NAME LTTR ENCL KREBS,M. 1 1 HEBDON,F 1 1 D WILLIAMS,J. 1 1 INTERNAL: ACNW 2 2 ACRS 2 2 AEOD/DOA 1 1 AEOD/DSP/TPAB 1 1 AEOD/ROAB/DSP 2 2 NRR/DET/ECMB 9H 1 1 NRR/DET/EMEB 7E 1 1 NRR/DLPQ/LHFB10 1 1 NRR/DLPQ/LPEB10 1 1 NRR/DOEA/OEAB 1 NRR/DREP/PRPB11 2 2 NRR/DST/SELB 8D '

1 NRR/DST/SICB8H3 1 1 SV B8D1 1 1 NRR/DST/SRXB 8E 1 1 EG FI 02 1 1 RES/DSIR/EIB 1 1 RG 2 FILE 01 1 1 EXTERNAL: EG&G BRYCE,J.H 3 3 L ST LOBBY WARD 1 1 NRC PDR 1 1 NSIC MURPHY,G.A 1 1 NSIC POORE,W. 1 1 NUDOCS FULL TXT 1 1 D

D D

NOTE TO ALL "RIDS" RECIPIENTS:

PLEASE HELP US TO REDUCE WASTE! CONTACT THE DOCUMENT CONTROL DESK ROOM PI-37 (EXT. 20079) TO ELIMINATEYOUR NAME FROM DISTRIBUTION LISTS FOR DOCUMENTS YOU DON'T NEED!

FULL TEXT CONVERSION REQUIRED TOTAL NUMBER OF COPIES REQUIRED: LTTR 33 ENCL 33

IS i~

tj

Tennessee valley,Autnority, post office Box 2000, Decatur,rAlabama 35609 O. J. 'Ike'eringue Vice President. Browns Ferry Operations JUN 25 ]991 U.S. Nuclear 'Regul'atory Commission ATTN: 'Document Control Desk Washington, D.C'. 20555

Dear Sir:

TVA BROGANS FERRY NUCLEAR PLANT (BFN) UNIT' DOCKET NO. 50-296 FACILITY OPERATING LICENSE DPR-68 REPORTABLE OCCURRENCE REPORT BFRO-50-296/91003 Rl The enclosed supplemental report provides details concerning an unplanned engineered safety 'feature actuation that occurred'esulting from personnel error while performing a common accident signal logic surveillance instruction. This report is submitted in accordance with 10 CFR 50.73(a)(2)(iv).

As agreed with BFN senior resident inspector, the due date for this Licensee Event Report has been extended to June 26, 1991'.

Very truly yours, TENNESSEE VALLEY AUTHORITY Enclosure cc: see page 2

'~10702014S FOR aooc~: o=oc>o&6 S PDR

0 U'S. Nuclear Regulatory Commission gag gg 1991 cc (Enclosure):

INPO Records Center Suite 1500 1100 Circle 75 Parkway Atlanta, Georgia 30339 NRC Resident Inspector, BFN Regional'Administration

'U.S. Nuclear Regulatory 'Commission Office of Inspection and Enforcement Region II 101 Marietta Street, Suite 2900 Atlanta, Georgia 30323 Thierry M. Ross U.'S. Nuclear Regulatory Commission One White Flint, North 11555 Rockville. Pike Rockville, Maryland 20852

(6-89) 0rm FACILITY NAME (1)

L N

SEE EVENT REPORT MMI (LER) t Approve HB No.

Expires 4/30/92 (DOCKET NUMBER (2) 15 - 104 Br w TITLE (4) An Unplanned Engineered Safety Feature Occurred From Personnel Error While Performing a Comnon Accident v

I I I I I SEqUENTIAL PREVISION( J i i FACILITY NAMES iDOCKET NUMBER(S)

I 'I I I I I I I I I 4 0 625 91 OPERATING I ITHIS REPORT IS SUBMITTED PURSUANT TO THE RE()UIREHENTS OF 10 CFR 5:

MODE I I I20.402(b) I20.405(c) f~)50.73(a)(2)(iv) (73.71(b)

POWER I I f20.405(a)( 1)(i) i50.36(c)(1) f50.73(a)(2)(v) [73.71(e)

LEVEL I [20.405(a)( l)(ii) /50.36(c)(2) 150.73(a)(2)(vii) )OTHER (Specify in

/20.405(a)(l)(iii) /50.73(a)(2)(i) )50.73(a)(2)(viii)(A) ] Abstract below and in

[20.405(a)( 1)(iv) /50.73(a)(2)(ii) [50.73(a)(2)(v'iii)(B) ( Text, NRC Form 366A) 2 4 v T F NAME I AREA CODE I MP T I I IREPORTABLEI I I I IREPORTABLEI MP N N MA D 0 4 I I SUBMISSION I I I E 0 I D T X N ABSTRACT (Limit to 1400 spaces, i.e., approximately fifteen single-space typewritten lines) (16)

On April 12, 1991 at 1817 hours0.021 days <br />0.505 hours <br />0.003 weeks <br />6.913685e-4 months <br />, an unplanned engineered safety feature (ESF) actuation occurred when the four Unit 3 emergency diesel generators (EDGs) unexpectedly auto-started during the performance of common accident signal (CAS) logic Surveillance Instruction (SI). The automatic initiat'ion of an ESF is reportable in accordance with 10 CFR 50.73(a)(2)(iv).

The cause of this event is personnel error resulting from a lack of attention to detail during installation of an inhibiting boot between two contacts on the Division II core spray logic B relay.

Corrective actions performed were: Operations personnel ensured 'Electrical Maintenance (EM) personnel stopped the performance of the SI; an incident investigation was conducted .to determine the cause of the event; and EMs resumed and successfully completed the 1/2 CAS SI. Maintenance personnel who install boots will receive training on the proper installation of boots by July 1, 1991.

NRC Form 366(6-89)

il NRC orm 3 A U.S. 'LEAR REGULATORY COMNISSION Approved OHB No. 3150-0104 (6-89) Expires 4/30/92 LI SEE EVENT REPORT (LER)

TEXT CONTINUATION FACILITY'NAME (,1) )DOCKET NUHBER (2)

A I I I I SEQUENTIAL I I REVI SION I I I I I I I I I I w F TEXT (If more space is required, use additional 'NRC Form 366A's) (17)

On April 12, 1991, at 1817 hours0.021 days <br />0.505 hours <br />0.003 weeks <br />6.913685e-4 months <br /> CST, an unplanned engineered safety feature (ESF) actuation occurred during the performance of Common Accident Signal (CAS)

Logic Surveillance Instruction (SI) 1/2 SI-4.9.A.3.a, when the four Unit 3 emergency diesel generators (EDGs) [EK] unexpectedly auto-started. In addition, the Unit 3 4kV shutdown board manual transfer switches [EB] tripped to .manual, and A3 residual heat removal service water (RHRSW) [CC] pump also started.

I The Unit 1/2 CAS Logic Surveillance is performed to verify that both divisions of the CAS logic will function on actuation of the Core Spray (CS) System of each reactor to provide an automatic start signal to all 4 Unit 1/2 EDGs and 4 RHRSW pumps and blocks transfer to the 4KV shutdown buses and boards.

On April 12, 1991, Division I testing of 1/2-SI-4.9.A.3'.a was'ompleted at 1600 hours0.0185 days <br />0.444 hours <br />0.00265 weeks <br />6.088e-4 months <br /> and Division II of the CAS logic testing was started at 1630 hours0.0189 days <br />0.453 hours <br />0.0027 weeks <br />6.20215e-4 months <br />. At approximately 1817 hours0.021 days <br />0.505 hours <br />0.003 weeks <br />6.913685e-4 months <br />, the CAS logic circuitry was aligned for testing relay CASB-1. This involved placing test switches for the remaining relays of the division in the TEST position to prevent undesired initiation of Units 1/2 ESF equipment. The CASB-1 relay [RLY] was then energized using the CASB-C test switch. Contacts were verified to be operating properly, and the appropriate trip to manual bus reset circuit relays were verified to trip. Boots were installed on contacts 11-12 of the CS logic relay to inhibit a Unit 2 accident signal to the Unit 3 CAS logic circuitry. A jumper with an in-line test switch in the open position was installed to the CS logic relay coil. The in-line test switch was closed, energizing CS logic relay. CASB-C test switch was then placed in the NORMAL position, and relay CASB-1 was verified to remain energized. The in-line test switch was then opened, and relay CASB-1 verified to be de-energized.

Since this SI was being performed on Unit 2 and only the four Uni,t 3 EDGs actuated, the EMs did not realize that the Unit 3 EDGs had actuated. EMs continued performing the SI. At 1820 hours0.0211 days <br />0.506 hours <br />0.00301 weeks <br />6.9251e-4 months <br />, EMs attempted to contact an Auxiliary Unit Operator (utility, non-licensed) to place the Unit 2 Division II CASB-1 in TEST position. At that time, the EMs were notified that the Unit 3 EDGs had actuated. The SI was stopped. Shutdown activity was completed by 1940 hours0.0225 days <br />0.539 hours <br />0.00321 weeks <br />7.3817e-4 months <br /> after .the Unit Operator (utility, licensed) completed the manual shutdown of the Unit 3 EDGs.

The automatic initiation of an ESF is reportable in accordance with 10 CFR 50.73(a)(2)(iv).

NRC Form 366(6-89)

C NRC Form 366A (6-89)

FACILITY NAME (1)

U~ S. N LIC LEAR REGULATORY COMMISSION SEE EVENT REPORT (LER)

TEXT CONTINUATION IOOCKET NUM8ER (2) l Approved OM8 No. 3150-0104 Expires 4/30/92 I I I SEQUENTIAL I I REVI SION I I I I I I I I I I TEXT (If more space is required, use additional NRC Form 366A's) (17)

The EDGs are the standby AC power system to provide a self-contained, highly reliable source of power as required for the engineered safeguards systems. The EDGs ensure that no single credible event can disable the core standby cooling functions or their supporting auxiliaries. The initiation of the Unit 3 EDGs resulting from CAS logic initiation placed the plant in a safe position. All circuits performed as'ould have been required during a valid accident condition.

Electrical System Engineers evaluated five possible scenarios which could have caused this event. The scenarios included: (1) performance of a different SI being conducted at the time of the event;, (2) an undervoltage/degraded voltage signal; (3) the CAS relay energized due to a pre-accident signal; (4) voltage spike or voltage transient; and (5) CAS actuated common accident start relay.

After an exhaustive and thorough investigation, each member of the investigation team and other Operations and System Engineering personnel independently arrived at the conclusion that no hardware problems existed in the circuitry and the only plausible scenario for this event is number 5.

Regarding scenario number 5, for all four of the Unit 3 EDGs to auto-start on a CAS while performing the SI, Contacts 11-12 on CS logic relay would have to be closed and a CAS or a simulated actuation signal to be present to energize the common accident start relay. At the time of this event, Unit 1 and 3 CS logic A and B relays were previously disabled. These relays did not supply the CAS initiations in this event. Unit 2 CS logic A and B relays were available to initiate the CAS. The keylock test switches for Unit 2 Division CAS relays II were placed in the TEST position to ensure the Unit 1 and 2 EDGs would not auto-start.

The SI required that Unit 2 CS logic B relay contacts 11-12 be booted open, and the boot secured with a gem clip to inhibit a CAS to auto-start Unit 3 EDGs.

For the start signal to have been-generated through contacts 11-12 of the CS logic relay and for the Unit 3 4kV Shutdown Board manual transfer switches to be tripped to manual, one of the following would have had to occur:

(1) The boot was defective.

(2) The boot was,temporarily mislanded or installed incorrectly.

(3) The relay contacts were inadvertently closed during installation of the boots for five seconds or more.

NRC Form 366(6-89)

0 il NRC Form 366A U.S. NUCLEAR REGULATORY COMMISSION Approved OMB No. 3150-0)04 (6-89) Expires 4/30/92 L NSEE EVENT REPORT (LER)

TEXT CONTINUATION FACILITY NAME (1) IOOCKET NUMBER (2)

I iSEQUENTIAL ( /REVISION( / [

I I I I I F

TEXT (If more space is required, use additional, NRC Form 366A's) (17)

The boot was inspected and no defects were found. The boot was found installed on the correct contacts during the subsequent investigation; additionally, personnel statements attest that the boot on contacts 11-12 of the CS logic relay was not temporarily mislanded or installed incorrectly. However, during the investigation, it was noted that the boot could be folded slightly and appear to be installed properly yet not cover the contact. Finally, it is unlikely that the CS logic logic relay could have been bumped for more than five seconds to cause an inadvertent closure. After an investigation of event number 5, TVA concluded that the boot was temporarily mislanded or installed incorrectly is the most likely scenario.

If this .SI event occurred at power the four Unit 3 EDGs would have auto-started and functioned as designed.

At the time of this event, Unit 2 was in cold shutdown with the control rods inserted. In addition, Unit 2 was in hydrostatic test alignment, namely, reactor vessel pressure was greater than 500 psig. Units 1 and 3 were defueled and no fuel handling or operations over the spent fuel were performed.

TVA has concluded the cause of this event is personnel error due to lack of attention when the inhibiting boot was improperly installed between two contacts on the division II CS logic B relay.

RE E N Performance of the SI was stopped; an incident investigation was conducted; on April 13, 1991 the EMs resumed and successfully completed the 1/2 CAS SI, thereby confirming that no hardware problem existed in the CAS circuitry.

Maintenance personnel who frequently install boots as part of routine testing should be made aware of this event and the potential to improperly install a boot through live time training by July 1, 1991.

On several events EDGs were unexpectedly actuated. These events were caused by the shorting of wires, jumpers, or other components during testing. The troubleshooting investigation for the April 12, 1991 event could not identify any problems with shorting of wires, jumpers or any other component that could have contributed to this event.

NRC Form 366(6-89)

0 il 0rm R RE ULAT RY HHI I N Approve OHB No. 3150-0104 (6-89) Expires 4/30/92 LI SEE EVENT REPORT (LER)

TEXT CONTINUATION FACILITY NAME (1) IOOCKET NUMBER (2)

I /SE()UENTIAL / /REVISION/

I I I I I TEXT (If more space is required, use additional NRC Form 366A's) (17)

LER 296/84007 Dated July 13, 1984. This LER addressed the actuation of the 3B EDG when EMs shorted two terminals while replacing a similar type relay. The 1984 personnel error did not contribute to the 1991 event since the SI steps involved in the Unit 3 EDG actuations di.d'ot require terminals to be removed or relanded.

LER 296/84008 Dated August 21, 1984.. This LER addressed the actuation of the Unit 3 EDGs resulting from ENs performing SI steps in reverse order. In the 1991 event ENs statements documented the 'SI steps were performed in accordance with the SI. Therefore, the 1984 root cause did not contribute to the 1991 event.

LER 296/86002 Dated February 12, 1986. This LER addressed an ESF actuation of Unit 3 EDGs. The root cause was personnel error when ENs missed a step in the SI to place a signal inhibiting,boot on the pre-accident relay. Although personnel error was the root cause in the 1986 and 1991 events, in the 1991 event the inhibiting boot was found properly installed.

LER 260/88001 Dated June 7., 1988. This LER addressed the actuation of the 3A EDG resulting from an inhibiting boot falling off a relay contact. The root cause for the boot falling off was random movement during relay cycling. The 1988 event did not contribute to this 1991 event since the boots were secured with a gem clip and were found .on the relay contacts during the investigation.

LER 259/89014 Dated June 30, 1989. This LER addressed the auto-start of the 1B and 1D EDGs during the performance of the same SI as in the 1991 event. This auto-start was the result of ENs allowing a wire they were attempting to reland to touch contact ll. ENs in the 1991 event attested to the fact that all wire relands were completed in accordance with the SI and without incident.

Therefore, the 1989 LER's root cause did,not contribute to the 1991 event.

LER 259/91004 occurring on April ll, 1991. This LER addressed the actuation of four 1/2 EDGs resulting from an Assistant Unit Operator placing the wrong switch in the test position. TVA concluded that operator error, as in LER 259/91004, did not contribute to this LER 296/91003 event.

Maintenance personnel who frequently install boots as part of routine testing should be made aware of this event and the potential to improperly install a boot through live time training by July 1, 1991.

Energy Industry Identification System (EIIS) codes are identified in the text as

[xx].

NRC Fo'rm 366(6-89)

Ik Cl l

j I t

1I