05000259/LER-2011-003, For Browns Ferry, Unit 1, Regarding Loss of Safety Function (SDC) Resulting from Emergency Diesel Generator Output Breaker Trip

For Browns Ferry, Unit 1, Regarding Loss of Safety Function (SDC) Resulting from Emergency Diesel Generator Output Breaker Trip

ML11188A154
Person / Time
Site:	Browns Ferry
Issue date:	07/01/2011
From:	Polson K Tennessee Valley Authority
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
LER 11-003-00
Download: ML11188A154 (10)

LER-2011-003, For Browns Ferry, Unit 1, Regarding Loss of Safety Function (SDC) Resulting from Emergency Diesel Generator Output Breaker Trip

Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(iv)(A), System Actuation 10 CFR 50.73(a)(2)(iv)(B), System Actuation 10 CFR 50.73(a)(2)(v)(B), Loss of Safety Function - Remove Residual Heat 10 CFR 50.73(a)(2)(i) 10 CFR 50.73(a)(2)(vii), Common Cause Inoperability 10 CFR 50.73(a)(2)(ii)(A), Seriously Degraded 10 CFR 50.73(a)(2)(viii)(A) 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition 10 CFR 50.73(a)(2) 10 CFR 50.73(a)(2)(iii) 10 CFR 50.73(a)(2)(ix)(A) 10 CFR 50.73(a)(2)(x) 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor 10 CFR 50.73(a)(2)(i)(A), Completion of TS Shutdown 10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications
2592011003R00 - NRC Website

text

Tennessee Valley Authority, Post Office Box 2000, Decatur, Alabama 35609-2000 July 1, 2011 10 CFR 50.73 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, D.C. 20555-0001 Browns Ferry Nuclear Plant, Unit 1 Facility Operating License No. DPR-33 NRC Docket No. 50-259

Subject:

Licensee Event Report 50-259/2011-003-00 On April 27, 2011, severe weather in the Tennessee Valley Service Area caused grid instability and loss of all 500-kV offsite power sources that resulted in scrams of all three Browns Ferry Nuclear Plant (BFN) units. On May 2, 2011, with all three BFN units in cold shutdown and power supplied by onsite emergency diesel generators (EDGs), the output breaker of the Unit 1/2 A EDG tripped. This resulted in a Primary Containment Isolation System actuation, which caused the loss of Shutdown Cooling for BFN Unit 1.

The Tennessee Valley Authority is submitting this report in accordance with 10 CFR 50.73(a)(2)(iv)(A), as any event or condition that resulted in manual or automatic actuation of any of the systems listed in 10 CFR 50.73(a)(2)(iv)(B); and 10 CFR 50.73(a)(2)(v)(B), as any event that could have prevented the fulfillment of the safety function of structures or systems that are needed to remove residual heat.

TVA is currently completing the investigation and evaluation for this event. Upon completion of these actions, TVA will submit a revised LER.

U.S. Nuclear Regulatory Commission Page 2 July 1, 2011 There are no new regulatory commitments contained in this letter. Should you have any questions concerning this submittal, please contact J. E. Emens, Jr., Nuclear Site Licensing Manager, at (256) 729-2636.

Respectfully, 4ý'K. J. Polson'C Vice President

Enclosure:

Licensee Event Report 259/2011-003 - Loss of Safety Function (SDC)

Resulting from Emergency Diesel Generator Output Breaker Trip cc (w/ Enclosure):

NRC Regional Administrator - Region II NRC Senior Resident Inspector - Browns Ferry Nuclear Plant

Enclosure Browns Ferry Nuclear Plant Unit I Licensee Event Report 259/2011-003 Loss of Safety Function (SDC) Resulting from Emergency Diesel Generator Output Breaker Trip See Attached

NRC FORM 366 U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY OMB NO. 3150-0104 EXPIRES 10/13/2013 (10-2010)

, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

3. PAGE Browns Ferry Nuclear Plant (BFN) Unit 1 05000259 1 OF 7

4. TITLE Loss of Safety Function (SDC) Resulting from Emergency Diesel Generator Output Breaker Trip

5. EVENT DATE

6. LER NUMBER

7. REPORT DATE

8. OTHER FACILITIES INVOLVED YEAR YEAR SEQUENTIAL REV MONTH DAY YEAR FACILITY NAME DOCKET NUMBER NUMBER NO.

N/A 05000 FACILITY NAME DOCKET NUMBER

9. OPERATING MODE

11. THIS REPORT IS SUBMITTED PURSUANT TO THE REQUIREMENTS OF 10 CFR §: (Check all that apply)

El 20.2201(b)

El 20.2203(a)(3)(i) 0l 50.73(a)(2)(i)(C)

El 50.73(a)(2)(vii)

E] 20.2201(d)

El 20.2203(a)(3)(ii)

[I 50.73(a)(2)(ii)(A)

El 50.73(a)(2)(viii)(A)

El 20.2203(a)(1)

El 20.2203(a)(4)

[I 50.73(a)(2)(ii)(B)

El 50.73(a)(2)(vifi)(B)

El 20.2203(a)(2)(i)

[I 50.36(c)(1)(i)(A)

[I 50.73(a)(2)(iii)

El 50.73(a)(2)(ix)(A)

10. POWER LEVEL [I 20.2203(a)(2)(ii)

El 50.36(c)(1)(ii)(A) 50.73(a)(2)(iv)(A) 50.73(a)(2)(x)

[I 20.2203(a)(2)(iii)

El 50.36(c)(2)

El 50.73(a)(2)(v)(A)

El 73.71(a)(4)

[I 20.2203(a)(2)(iv)

El 50.46(a)(3)(ii)

Z 50.73(a)(2)(v)(B)

El 73.71(a)(5) 000 [E

20.2203(a)(2)(v)

El 50.73(a)(2)(i)(A)

[E 50.73(a)(2)(v)(C)

El OTHER [E

20.2203(a)(2)(vi)

[E 50.73(a)(2)(i)(B)

El 50.73(a)(2)(v)(D)

Specify in Abstract below or in

I. PLANT CONDITION(S)

On April 27, 2011, severe weather in the Tennessee Valley Service Area caused grid instability and a loss of all 500-kV offsite power sources that resulted in scrams of all three Browns Ferry Nuclear Plant (BFN) units.

At the time of the event being reported (May 2, 2011, at 0626 hours0.00725 days <br />0.174 hours <br />0.00104 weeks <br />2.38193e-4 months <br /> Central Daylight Time),

BFN Units 1, 2, and 3 were in Mode 4 (Cold Shutdown) with all control rods already inserted into the core and with shutdown 4-kV busses [EB] supplied by 6 of 8 onsite emergency diesel generators (EDG) [EK] and a 161-kV offsite power source.

II. DESCRIPTION OF EVENT

A. Event:

On May 2, 2011, at 0626 hours0.00725 days <br />0.174 hours <br />0.00104 weeks <br />2.38193e-4 months <br />, while 6 of 8 EDGs and a 161-4kV offsite power source were in use to provide AC power for core cooling loads, the output breaker of the Unit 1/2 A EDG tripped.

The A EDG output breaker trip interrupted power to 4-kV Shutdown Board A [EB],

caused a loss of power to a portion of the Unit 1 Reactor Protection System (RPS A)

[JC], and led to Primary Containment Isolation System (PCIS) [JE][JM] Group 2, 3, 6, and 8 isolations. The Group 2 isolation caused the loss of Unit 1 Residual Heat Removal (RHR) System [BO] Shutdown Cooling (SDC). Unit 2 was not affected by this event.

On May 2, 2011, at 0723 hours0.00837 days <br />0.201 hours <br />0.0012 weeks <br />2.751015e-4 months <br />, after power had been restored to 4-kV Shutdown Board A using a 161-kV offsite power source, Operations personnel placed Unit 1 SDC in service. The A EDG output breaker trip had caused the loss of SDC for approximately 57 minutes.

With an automatic start signal present, each EDG is protected against damage from overspeed by use of an Overspeed Trip Limit Switch (OTLS). The OTLS is positioned against the engine mechanical Overspeed Trip (OT) Lever Arm. When the engine overspeeds, the mechanical lever arm is mechanically released and rotates clockwise (from the front of the engine), which results in engine shutdown by locking out fuel delivery to the power assembly.

The underlying cause for the A EDG output breaker trip was inadvertent (false) actuation of the OTLS.

B. Inoperable Structures, Components, or Systems that Contributed to the Event:

Loss of offsite power was a contributor to this event.

C. Dates and Approximate Times of Maior Occurrences:

April 27, 2011, at 1636 hours0.0189 days <br />0.454 hours <br />0.00271 weeks <br />6.22498e-4 months <br /> Loss of all 500-kV offsite power sources. All three BFN units automatically scram and 7 of 8 EDGs start (3B EDG was inoperable and unavailable due to planned maintenance). One 161 -kV offsite power source remained available.

1 NRC FORM 366 (10-2010)

May 2, 2011, at 0626 hours0.00725 days <br />0.174 hours <br />0.00104 weeks <br />2.38193e-4 months <br /> at 0643 hours0.00744 days <br />0.179 hours <br />0.00106 weeks <br />2.446615e-4 months <br /> at 0652 hours0.00755 days <br />0.181 hours <br />0.00108 weeks <br />2.48086e-4 months <br /> at 0723 hours0.00837 days <br />0.201 hours <br />0.0012 weeks <br />2.751015e-4 months <br /> at 2010 hours0.0233 days <br />0.558 hours <br />0.00332 weeks <br />7.64805e-4 months <br /> The output breaker of the A EDG trips and power is lost to 4-kV Shutdown Board A. Unit 1 SDC isolated. Received half scram (due to loss of RPS A) and PCIS Group 2, 3, 6, & 8 isolations.

Power is restored to 4-kV Shutdown Board A from a 161-kV offsite power source.

Half scram and PCIS isolations were reset.

Unit 1 SDC restored.

All shutdown boards are powered from two qualified 161-kV offsite power sources, and all EDGs are shutdown and in standby readiness.

D. Other Systems or Secondary Functions Affected

None

E. Method of Discovery

The EDG output breaker trip was self-revealing as the power lost to the associated 4-kV Shutdown Board caused multiple Main Control Room alarms, which required Operations personnel response.

F. Operator Actions

In response to the loss of power, Operations personnel restored power to 4-kV Shutdown Board A using a 161-kV offsite power source, reset the PCIS isolations, and returned Unit 1 SDC to service.

G. Safety System Responses:

All onsite safe shutdown equipment required for Unit 1 was available.

I1l. CAUSE OF THE EVENT TVA is currently completing the investigation for extent of condition and cause for this event. Upon completion of these actions, TVA will submit a revised LER. Until then, some of the following information is considered preliminary.

A. Immediate Cause:

The underlying cause for the A EDG output breaker trip was inadvertent (false) actuation of the OTLS.

B. Root Cause:

The root cause of the event was concluded to be inadequate technical rigor applied by Site Engineering personnel to recognize system vulnerabilities. This resulted in inadequate engineering guidance for maintenance personnel to properly configure the OTLS. The root cause analysis identified the inadvertent output breaker trip to be a result of insufficient detail in maintenance procedures to allow for appropriate calibration and/or alignment of the OTLS switch arm and/or OT lever.

NRC FORM 366 (10-2010)

An equipment cause evaluation was performed and concluded that there are deficiencies within the corrective maintenance instructions regarding OT devices on the EDGs which have not identified aging aspects, inspection, adjustment or replacement frequency, pertaining to the OTLS on each of the EDGs.

Extent of Condition The inadvertent trip of the output breaker on the A EDG was concluded to have resulted from a marginal setting on the OTLS arm. Actuation of the OTLS will result in annunciation for OVERSPEED TRIP, and NOT AUTO. Additionally, the OT relay will be energized resulting in opening of the EDG output breaker and lockout of the engine start circuit. This specific component is considered a single point vulnerability for the EDG in which alternate power sources and/or return to normal power sources are required to be aligned to complete the safety related function.

Additionally, the OT lever mechanism has the potential to have degradation or wear in/at the interface between the trip pawl and within the OT lever assembly, which could result in a change in the original position of the OT lever when reset. The OTLS in this event is specific to the EDG in which the OT devices were installed on all (8) EDGs (A, B, C, D, 3A, 38, 3C, and 3D). Thus the extent of condition was limited to the EDGs.

Troubleshooting revealed that the as-found state of the OTLS contact was closed even though the mechanical overspeed lever arm had not actuated. Therefore, the A EDG output breaker trip was directly caused by a misadjusted OTLS arm. This OTLS was found to be of a different model than was installed on the other 7 EDGs and exhibited some sticking when exercising the arm. Thus, this OTLS was replaced with the same model as is installed on the other 7 EDGs.

Lab analysis of the removed A EDG OTLS indicated that some sticking occurred with the switch in an actuated state (clockwise from shelf state) and some metallic filings were present, but no other anomalies were identified. These anomalies would not result in a premature actuation of the switch. Thus, the lab technical report supports the conclusion that the OTLS arm was misadjusted and resulted in inadvertent actuation.

Immediate corrective actions to replace OTLSs on all EDGs were performed and acceptable margin with OTLS arm verified. Additional work orders were initiated to perform condition inspections of the OT assemblies for each EDG. These actions will provide a reasonable assurance that the overspeed device will function as intended.

Extent of Cause Inadvertent overspeed trips have occurred numerous times on EDGs, both at BFN and across the nuclear power industry. Evaluations are performed to assess equipment reliability issues, and periodic self assessments are performed to document the state of the systems and review areas for improvement regarding owner's group recommendations for preventive maintenance and industry experience.

Despite these evaluations, the OTLS was not considered as a vulnerability to an EDG functional failure and resulted in the inadvertent output breaker trip.

NRC FORM 366 (10-2010)

IV. ANALYSIS OF THE EVENT

The Tennessee Valley Authority (TVA) is reporting this event in accordance with 10 CFR 50.73(a)(2)(iv)(A), as any event or condition that resulted in manual or automatic actuation of any of the systems listed in 10 CFR 50.73(a)(2)(iv)(B). This event is also reportable in accordance with 10 CFR 50.73(a)(2)(v)(B), as any event that could have prevented the fulfillment of the safety function of structures or systems that are needed to remove residual heat.

Evaluation of Plant Systems/Components Based on review of plant system records (including operating logs), following the A EDG output breaker trip, power was lost to plant equipment fed from 4-kV Shutdown Board A.

With the loss of power to RPS A (half scram), all automatic actuations occurred, all actuations were completed, and required systems started and functioned successfully.

The Unit 1/2 A EDG is a common EDG, which feeds Unit 1 and Unit 2 equipment. The A EDG output breaker trip interrupted power to 4-kV Shutdown Board A, caused a loss of power to Unit 1 RPS A, and led to PCIS Groups 2, 3, 6, and 8 isolations. The Group 2 isolation caused the loss of Unit 1 RHR SDC.

No other significant, post-event failures or issues were identified.

Evaluation of Personnel Performance Operations personnel performance following the event was reviewed and evaluated and found acceptable.

SDC was restored 57 minutes later in accordance with Abnormal Operating Instruction (AOI) 1-AOI-74, Loss of Shutdown Cooling.

Other Analyses TVA is currently evaluating the potential that this condition may have resulted in past inoperability of the A EDG. If this is found to be the case, a it will be addressed in the previously mentioned revision to this LER.

V. ASSESSMENT OF SAFETY CONSEQUENCES

The EDGs are one of the most important risk-significant BFN systems. Loss of an EDG limits the capability for the unit to respond to an accident or transient when accompanied by a loss of offsite power.

The Unit 1/2 A EDG operated for approximately 4 days and 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br /> prior to the output breaker trip. This period of operation did not meet the 7-day mission time of the A EDG. If multiple EDGs had experienced the same failure under the same event scenario, BFN could have lost its ability to provide power to components essential for heat removal from the reactor vessel. However, at the time of this event, Unit 1/2 B, C, and D EDGs and a 161-kV offsite power source were operable and all of the Emergency Core Cooling Systems were operable, there was sufficient redundancy to support the core cooling requirements for Units 1 and 2.

NRC FORM 366 (10-2010)

Three of the four Unit 1/2 EDGs were operable to support both Units 1 and 2 following the three-unit scram event that began on April 27, 2011, until all shutdown boards were powered from qualified 161 -kV offsite power sources, and all EDGs were shutdown and in standby readiness. As reported in LER 259/2011-002-00, the C EDG developed a hydraulic oil leak and was shutdown at 31 hours3.587963e-4 days <br />0.00861 hours <br />5.125661e-5 weeks <br />1.17955e-5 months <br /> into the three-unit scram event and was returned to operable status prior to the A EDG output breaker trip event. The C EDG was not required to be started because the remaining two EDGs and a 161-kV offsite power source maintained the required loads.

Therefore, because sufficient onsite and offsite power sources were available at the time of the event and afterwards, this event was of minimal nuclear safety significance.

This event was not significant from a radiological safety standpoint. The A EDG output breaker trip caused a loss of Unit 1 SDC on Unit 1 for 57 minutes. This information is relevant because the time to boil for the Unit 1 Spent Fuel Pool Water (airborne radioactive contamination risk) was approximately 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />. Also, Technical Specification 3.4.8, Residual Heat Removal (RHR) Shutdown Cooling System - Cold Shutdown, contains provisions that allow RHR SDC subsystems to be out of service for up to one hour.

VI. CORRECTIVE ACTIONS

Corrective actions are being managed within TVA's Corrective Action Program. These corrective actions may be modified based on further evaluation.

A. Immediate and Corrective Actions:

The A EDG output breaker trip was initiated by the OTLS, which was found to be of a different model than the other 7 EDGs and, post-event, exhibited some sticking when exercising the OTLS arm. After evaluation of the problem (including laboratory analysis), it was determined that the preliminary extent of condition was limited to a mis-adjustment of this OTLS and not a component defect or failure. Therefore, the A EDG OTLS was replaced with the same model as the other 7 EDGs and was adjusted properly.

Immediate actions taken included:

Adjustments to the A EDG OTLS arm to return the A EDG to an available status and Cycling of the other 7 EDG OTLS arms to ensure proper settings and response.

Corrective actions taken and planned are as follows:

Replacement of the OTLSs was completed for all 8 EDGs and each was verified to have acceptable margin present, Work Orders for the inspection of the OT assemblies for all 8 EDGs were initiated,

" Self-assessments of the High Pressure Coolant Injection [B1J], Reactor Core Isolation Cooling [BN], RHR, and Emergency Equipment Cooling Water [BI]

Systems for vulnerabilities to functional failure, including o

gap analyses between these assessments and previous ones and o

a review of these results to develop a comprehensive listing of gaps for engineering management review, I

NRC FORM 366 (10-2010)

A review of all EDGs for single point vulnerabilities to functional failure including a self-assessment of EDG vulnerabilities for trip-related functions, Potential generic applicability reviews from the other TVA nuclear plants, Preventative maintenance to inspect, test, and establish a replacement frequency for EDG OT devices based on TVA fleet and owner's group recommendations, and Maintenance procedure revisions to correct inadequacies in OT lever arm inspections and to incorporate steps for adjustment and verification of the OTLS arm within a specified margin.

B. Corrective Actions to Prevent Recurrence:

Corrective actions to prevent recurrence planned are as follows:

Training for Site Engineering personnel to improve technical rigor, Internal challenge board reviews of all critical engineering external correspondence, Engineering Department Corrective Action Review Board focus on documentation of critical thinking, and Improved procedural requirements and processes for evaluation of equipment failures to support continuing equipment reliability improvement, which includes trending and initiating corrective actions to improve equipment reliability and training for all technical staff to ensure proper use.

VII. ADDITIONAL INFORMATION

A.

Failed Components:

None B.

Previous LERS or Similar Events:

A search of LERs for BFN Units 1, 2, and 3 for approximately the past five years did not identify any similar issues involving EDG output breaker trips or issues with the OTLS.

A search of the TVA BFN corrective action program was performed. There were several Problem Evaluation Reports (PERs) that documented OTLS issues. One of the PERs reviewed was associated with a recent 3B EDG OTLS problem; however, that problem was concluded to be from a different failure mechanism (mechanical binding) that resulted from component aging issues.

C.

Additional Information

The corrective action document for this report is PER 362340.

D.

Safety System Functional Failure Consideration:

This event is a safety system functional failure in accordance with NEI 99-02.

E.

Scram With Complications Consideration:

This event did not include a reactor scram.

VIII. COMMITMENTS

None NRC FORM 366 (10-2010)