05000296/LER-2011-001

LER-2011-001, Loss of Shutdown Cooling (RHR)

Browns Ferry Nuclear Plant Unit 3
Event date:	05-12-2011
Report date:	01-05-2012
Reporting criterion:	10 CFR 50.73(a)(2)(v), Loss of Safety Function
2962011001R01 - NRC Website

10. POWER LEVEL

000 - 12. LICENSEE CONTACT FOR THIS LER == FACILITY NAME ==

Paul A Herrmann Ill, Licensing Programs Manager TELEPHONE NUMBER (Include Area Code) 256-729-7479 == 13. COMPLETE ONE LINE FOR EACH COMPONENT FAILURE DESCRIBED IN THIS REPORT ==

CAUSE SYSTEM COMPONENT MANU- FACTURER == REPORTABLE ==

TO EPIX CAUSE SYSTEM COMPONENT

MANU- == FACTURER ==

14. SUPPLEMENTAL REPORT EXPECTED

• YES (If yes, complete 15. EXPECTED SUBMISSION DATE)

• NO _ == 15. EXPECTED ==

MONTH DAY YEAR

N/A N/A N/A On May 12, 2011, at 1825 hours Central Daylight Time (CDT), Browns Ferry Nuclear Plant (BFN)- Unit 3 was in Mode 4, as a result of the severe weather event that occurred on April 27, 2011. Relay maintenance activities in the Primary Containment Isolation System (PCIS) inadvertently de-energized a Group 2 PCIS relay, which initiated a partial Group 2 PCIS isolation.

The partial Group 2 isolation caused a trip of the 3B Residual Heat Removal (RHR) pump, which subSequently resulted in a loss of shutdown cooling (SDC). The relay wires were re-connected and SDC was restored on BFN-Unit 3 at 1905 hours CDT. Moderator temperature prior to the event was 112.5 degrees Fahrenheit (F) and the highest moderator temperature recorded during the loss of SDC event was 122 degrees F.

This condition is reportable under 10 CFR 50.72(b)(3)(v), any event or condition that at the time of discovery could have prevented the fulfillment of the safety function of structures or systems that are needed to: (B) Remove Residual Heat., A 60 day written report was required in accordance with 10 CFR 50.73(a)(2)(v), any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to: (B) Remove Residual Heat.

I. PLANT CONDITIONS

On April 27, 2011, severe weather in the Tennessee Valley service area caused grid instability and a loss of all 500-kV offsite power sources that resulted in scrams on all three Browns Ferry Nuclear Plant (BFN) units.

On May 12, 2011, at 1825 hours Central Daylight Time (CDT), as a result of the aforementioned severe weather event, BFN-Unit 3 was in Mode 4 at zero percent power.

On May 12, 2011, at 1825 hours CDT, as a result of the aforementioned weather event, BFN Units 1 and 2 were also in Mode 4 at zero percent power.

II. DESCRIPTION OF THE EVENT

A. Event On May 12, 2011, scheduled maintenance activities at BFN Unit 3 were in the process of replacing relay assemblies. Prior to performing the relay replacements, electricians performed a live-dead-live test that revealed the presence of electrical energy. This was an unexpected condition and the electricians stopped their work activities. The Electrical Supervisor reported this condition to the Operations representative in the Outage Control Center (OCC). Operations personnel reached a decision to allow this work to proceed.

Maintenance activities were directed to resume on relay BFN-3-RLY-064-16AK56 [RLY], [Main Steam Line Drain Isolation Inboard Group 1 Primary Containment Isolation Valve [ISV] (PCIV)] pursuant to a Preventive Maintenance (PM) Work Order, 09-715863-000.

On May 12, 2011, at 1825 hours CDT, electricians from Electrical Maintenance were performing PM activities as described above on GE CR120A relays. A Residual Heat Removal [BO] (RHR) pump [P] trip occurred while employees were working on Primary Containment Isolation System [BD] (PCIS) relay BFN-3-RLY-064-16AK56. Electricians lifted a neutral wire on the relay coil, which resulted in a Channel "A" partial Group 2 isolation. When the neutral wire was lifted, all energized relays downstream of relay BFN-3-RLY-064-16AK56 became de-energized; i.e., relay points changed state. One of the downstream energized relays was BFN-3-RLY-064-16AK29 [BO] RHR Isolation Contactor-Inboard Valve. This de-energized relay initiated a Channel "A," partial Group 2 isolation, resulting in the closure of valves BFN-3-FCV-074-0053 (RHR System Inboard Recirculation Loop Valve) and BFN-3-FCV-074-0048 (RHR Shutdown Cooling (SDC) Inboard Valve). Additionally, the 3B RHR pump tripped as a result of the valve closure. RHR shutdown cooling (SDC) was lost.

At 1840 hours CDT, electricians were directed to re-connect the wire. Operations personnel reset the partial Group 2 Isolation at 1845 hours CDT. On May 12, 2011, at approximately 1905 hours CDT, the 3B RHR pump was returned to service and SDC was restored for BFN-Unit 3.

Moderator temperature prior to the event was 112.5 degrees Fahrenheit (F) and the highest moderator temperature recorded during the loss of SDC was 122 degrees F.

After the event, management discussions concluded that work to replace PCIS relays was to be placed on hold. Other work for BFN, Unit 3, was to be authorized by the OCC Unit Operations Manager on a case-by-case basis and this was communicated to the Shift Manager. Operations personnel were directed to review all work packages prior to restarting BFN, Unit 3.

B. Inoperable Structures. Components, or Systems that Contributed to the === Event ===

There were no inoperable structures, components, or systems that contributed to this event.

C. Dates and Approximate Times of Major Occurrences On April 27, 2011, at 1636 hours CDT On May 12, 2011, at 1825 hours CDT at 1830 hours CDT at 1840 hours CDT at 1845 hours CDT at 1904 hours CDT at 1905 hours CDT at 1930 hours CDT at 2220 hours CDT On May 13, 2011 at 0053 hours CDT All BFN units entered Mode 4 as a result of a severe weather event causing a loss of off-site power to all units.

Operations received an annunciation notification that the 3B RHR pump tripped and an "A" Channel partial Group 2 PCIS Isolation is initiated.

A report was received by Operations that there were no breaker [BKR] issues and also no apparent problems for the 3B RHR pump.

Electricians report to Operations that when they lifted a neutral wire on relay BFN-3-RLY-064-16AK56, a partial Group 2 Isolation occurred. Electricians were instructed to re-connect the wire.

As instructed by Operations, the electricians re-connected wire for relay BFN-3-RLY-064-16AK56, and Operations reset the partial Group 2 isolation.

Operations placed capacitor banks in manual for 3B RHR pump start Operations returned Loop II to RHR SDC and confirmed that the 3B RHR pump was running.

Operations review determined that when RHR Pump 3B tripped, the motor tripout alarm was not received.

Operations logs report time to boil of 4.13 hours and 3B RHR pump in SDC.

Notification was made in accordance with 10 CFR 50.72(b)(3)(v).

D. Other Systems or Secondary Functions Affected

There were no other systems or secondary functions affected.

E. Method of Discovery

Several annunciation windows alarmed and alerted Operations to this event. These were:

Window 3-XA-55-3E, window 13, [3B RHR SYS II PUMP B TRIPPED].

Window 3-XA-55-3D, window 11, [RHR SD CLG FLOW LOW].

Window 3-XA-55-23C, window 26, [4160 V SD BD 3EC MOTOR OL OR TRIP].

These annunciation windows alerted Operations that the 3B RHR pump had tripped and that a partial Group 2 isolation had occurred.

A single annunciation window, Window 3-XA-55-8C, window 33 [MOTOR TRIPOUT], Did not illuminate.

F. Operator Actions

After determining the cause of the event, Operations had the neutral wire re-connected and reset the partial Group 2 isolation. The 3B RHR pump was restarted. Operations checked to ensure that the 3B RHR pump was running and that SDC had been restored.

G. Safety System Responses

Relay maintenance activities on a Group 1 PCIS relay interrupted the neutral in a Group 2 PCIS relay, initiating a partial Group 2 PCIS isolation which resulted in a loss of SDC. The relays caused a valve to close, resulting in the 3B RHR pump trip. Relays were reset and SDC was restored. SDC was lost for approximately 40 minutes.

Moderator temperature prior to the event was 112.5 degrees F and the highest moderator temperature recorded during the loss of SDC was 122 degrees F. All plant equipment and systems functioned as designed, except for a single annunciation window, Window 3-XA-55-8C, window 33 [, MOTOR TRIPOUT], which did not illuminate.

III. CAUSE OF THE EVENT

A. Immediate Cause Upon discussion with Operations, the electricians were directed to lift the leads while energized. The logic prints reviewed did not show the neutral for the relays. The direct cause of this event was the lifting of the wiring that was landed on the common side of a relay coil.

B. Root Cause The work package details did not include specific work precautions or instructions to require that jumpers be installed to prevent the loss of SDC. It was not obvious that the work package had been planned for a refueling outage (RFO) and did not take into consideration that the desired work activities could not be performed while the RHR was in service.

Contributing Factors

1. There was inadequate training on electrical fundamentals in the area of plant wiring and plant configuration.

2. There was a lack of consistency with the decisions and actions regarding the use of the Risk Management Process for outage scope additions. The outage scope process does not evaluate risk for the addition of pre-planned packages that were intended to be worked in a different mode of plant operation.

3. Conservative decision making was not used to evaluate the work task.

Maintenance and Operations Work Control discussed continuing this work with voltage present on the relay. Engineering was not consulted.

IV. ANALYSIS OF THE EVENT

A. Evaluation of Plant Systems/Components Originally, 17 PCIS relays were included in the forced outage work scope. After review by the Operations Manager, 3 PCIS relays were identified as directly affecting SDC and were removed from the scope of work. With the identification of these three relays, personnel were convinced that all relays had been identified that were .

high risk.

This outage package originally was screened as low risk when it was reviewed the first time due to the evolution taking place during a normal refueling outage (RFO) with plant conditions in the configuration assumed in the earlier review. The procedure was checked "NO" for causing an Engineered Safety Feature actuation due to the package being planned for an RFO with both loops of RHR out of service and Alternate Decay Heat Removal in service.

Personnel statements indicate that maintenance personnel discussed performance of the PM task with Operations before beginning work and obtained approval.

However, personnel statements do not indicate that the pre-job briefing for the relay replacement discussed whether or not the work order was appropriately planned for the current plant conditions.

Upon discussion with Operations, i.e., the Work Control Center, the Electricians were directed to lift the leads while energized. The logic prints did not show the neutral for the relays. If a better questioning attitude had been displayed by those involved, there is a higher probability that the wiring diagram would have been reviewed which would have identified the neutral wiring configuration on the relays.

The Tennessee Valley Authority is reporting this event in accordance with 10 CFR 50.73 (a)(2)(v), as any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to:

(B) Remove Residual Heat.

V. ASSESSMENT OF SAFETY CONSEQUENCES

For a loss of SDC, no unique safety actions are required. In these cases, SDC is re-established using other normal SDC equipment. In cases where the RHR SDC suction line becomes inoperable, a unique requirement for cooling arises. In cases in which the reactor vessel head is off, either half of the RHR-Low. Pressure Coolant ,

Injection (LPCI) mode can be used to maintain water level. In cases in which the , reactor vessel head is on and the system can be pressurized, the LPCI system, main steam relief valves (manually operated), and RHR-torus cooling mode can be used to maintain water level and remove decay heat.

Moderator temperature prior to the event was 112.5 degrees F and the highest moderator temperature recorded during the loss of SDC was 122 degrees F. Time to boil at the time of event was 4.13 hours. The small reported rise in moderator temperature would have resulted in a small decrease in the time to boil. Because of the small temperature rise and the prompt restoration of RHR SDC to maintain water level and remove decay heat, there were no safety consequences associated with this event.

VL CORRECTIVE ACTION

A. Immediate Corrective Actions

• Electricians re-landed neutral wire for relay BFN-3-RLY-64-16AK56.

• Operations reset the partial Group 2 Isolation at 1845 hours CDT.

• A work stoppage was issued by the Outage Director to cease all plant work activities until an initial investigation and review of the incident were performed.

• Plant management and supervisory personnel were briefed and instructed to *.

discuss the event with their employees to filter this information to the site organizations.

B. Corrective Actions to Prevent Recurrence

• Determine the scope of relay maintenance procedures which require revisions to verify that approved instructions are included in the implementing work plan to identify and place jumpers needed to maintain system logic during any work involving wire lifts which are part of a series (daisy-chain) circuit configuration.

• Verify that approved instructions are included in the applicable implementing work plan to identify and place jumpers needed to maintain system logic during any work involving wire lifts which are part of a daisy-chain circuit configuration.

• Re-evaluate and revise existing PCIS work packages to verify that approved instructions are included in the implementing work plan to identify and place jumpers needed to maintain system logic during any work involving wire lifts which are part of a daisy-chain circuit configuration.

• Plant management decided that if a refueling outage work order was being added to a forced outage per Procedure NPG-SPP-7.2.8, Outage Scope Control, the work order should be returned to a planning status for a review of the work order to verify that the work order can be performed in the current plant conditions or to identify the plant conditions needed to perform the work order.

A. Failed Components

Window 3-XA-55-8C, window 33 [MOTOR TRIPOUT], did not illuminate when RHR Pump 3B tripped. This is documented in Problem Evaluation Report (PER) 368629.

B. Previous Similar Events

A review of operations logs and the Corrective Action Program database concluded there were no previous similar events with a similar cause.

C. Additional Information

The corrective action document associated with this event is PER 368764.

D. Safety System Functional Failure Consideration

This event is classified as a safety-system functional failure according to NEI 99-02.

E. Scram With Complications Considerations This event was not a complicated scram according to NEI-99-02.

VII. COMMITMENTS

There are no commitments.