05000296/LER-2015-001

LER-2015-001, High Pressure Coolant Injection and Reactor Core Isolation Cooling Inoperable Due To No Suction Source Aligned

Browns Ferry Nuclear Plant, Unit 3
Event date:	02-11-2015
Report date:	04-13-2015
2962015001R00 - NRC Website

I. Plant Operating Conditions Before the Event

Browns Ferry Nuclear Plant (BFN), Unit 3, was in Mode 1 at approximately 100 percent rated thermal power.

II. Description of Events

A. Event:

On February 11, 2015, at approximately 0820 Central Standard Time, during the performance of surveillance procedure 3-SR-3.5.1.2 (HPCI), High Pressure Coolant Injection System Monthly Valve Position Verification, Operations personnel closed the supply breaker [BKR] for flow control valve 3-FCV-2-166, Condensate Storage Tank (CST)[KA] #3 Emergency Discharge Isolation Valve [ISV], in order to verify the isolation valve was in its required open position. Indications showed the isolation valve was full open, but it was observed that isolation valve 3-FCV-2-166 inadvertently closed when its associated breaker was closed. With BFN, Unit 3, High Pressure Coolant Injection (HPCI)[BJ] and Reactor Core Isolation Cooling (RCIC)[BR] normally both aligned to take suction from CST #3, 3-FCV-2-166 was a single isolation from CST #3. When the isolation valve was closed in this alignment, HPCI and RCIC were unable to perform their design safety functions to inject water into the core. Therefore, on February 11, 2015, at approximately 0820 Central Standard Time, Operations personnel declared HPCI and RCIC inoperable.

BFN, Unit 3, entered Technical Specifications (TS) Limiting Conditions for Operation (LCO) 3.5.1, which requires each Emergency Core Cooling System (ECCS) injection/spray subsystem and the Automatic Depressurization System (ADS)[SB] function of six safety/relief valves to be operable in reactor Mode 1, and Mode 2 and Mode 3 except when HPCI and ADS valves are not required to be operable with reactor steam dome pressure less than or equal to 150 pounds per square inch, gauge (psig). Condition G was entered due to Condition C, which requires verification by administrative means that RCIC system is operable and restoration of HPCI system within 14 days, not being met. Condition G requires the unit to be placed in Mode 3 (Hot Shutdown) within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and reduction of reactor steam dome pressure to less than or equal to 150 psig within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

Additionally, BFN, Unit 3, entered TS LCO 3.5.3, which requires the RCIC system to be operable in reactor Mode 1, and Mode 2 and Mode 3 with reactor steam dome pressure greater than 150 psig, for RCIC inoperability. Condition B was entered due to Condition A, which requires verification by administrative means that HPCI system is operable and restoration of RCIC system within 14 days, not being met.

Condition B requires the unit to be placed in Mode 3 (Hot Shutdown) within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and reduction of reactor steam dome pressure to less than or equal to 150 psig within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />.

On February 11, 2015, at approximately 0824 Central Standard Time, Operations personnel opened isolation valve 3-FCV-2-166 from the Unit 1 Control Room [NA], declared HPCI and RCIC Operable, and exited associated TS LCOs.

B. Status of structures, components, or systems that were inoperable at the start

of the event and that contributed to the event:

There were no structures, components, or systems that were inoperable at the start of the event and that contributed to the event.

C. Dates and approximate times of occurrences:

February 11, 2015, at 0730 Central Standard Time Operations personnel commenced surveillance procedure 3-SR-3.5.1.2 (HPCI).

February 11, 2015, at 0820 Central Standard Time Breaker 3-BKR-2-166 closed.

Isolation valve 3-FCV-2-166 spuriously closed.

HPCI and RCIC were declared inoperable due to no suction source aligned, and entered applicable TS actions.

February 11, 2015, at 0824 Central Standard Time Isolation valve 3-FCV-2-166 remotely opened from the Unit 1 Control Room.

Breaker 3-BKR-2-166 opened.

Operations declared HPCI and RCIC Operable following alignment of the CST for suction and exited applicable TS actions.

February 11, 2015, at 1516 Central Standard Time NRC was notified.

D. Manufacturer and model number (or other identification) of each component that failed during the event:

Hand switch [HS] 3-HS-2-166B was installed during initial construction. The manufacturer could not be identified.

E. Other systems or secondary functions affected:

There were no other systems or secondary systems affected.

F. Method of discovery of each component or system failure or procedural error:

On February 11, 2015, at approximately 0820 Central Standard Time, Operations personnel identified that isolation valve 3-FCV-2-166 inadvertently closed when its associated breaker was closed.

G. The failure mode, mechanism, and effect of each failed component, if known:

The cause for the inadvertent closure of isolation valve 3-FCV-2-166 was contacts on local hand switch 3-HS-2-166B being stuck closed when they should have been open.

H. Operator actions:

Operations personnel declared Unit 3 HPCI and RCIC inoperable due to no suction source aligned and entered TS LCO 3.5.1 Condition G for HPCI inoperability and TS LCO 3.5.3 Condition B for RCIC inoperability.

Operations personnel re-opened isolation valve 3-FCV-2-166 using hand switch 3-HS-2-166B in the Unit 1 Control Room and when the valve indicated full open, directed the operator in the field to open the breaker for 3-FCV-2-166 to prevent further movement.

Operations personnel declared Unit 3 HPCI and RCIC Operable following alignment of the CST for suction, and exited TS LCO 3.5.1 Condition G and TS LCO 3.5.3 Condition B.

I. Automatically and manually initiated safety system responses:

There were no automatic or manual safety system responses associated with this event.

III. Cause of the event:

A. The cause of each component or system failure or personnel error, if known:

The direct cause of this event was determined to be contacts on local hand switch 3-HS-2-166B being stuck closed instead of open.

B. The cause(s) and circumstances for each human performance related root cause:

The apparent cause of the event was determined to be inadequate design review of Design Change Notice (DCN) 69786 which allowed latent design vulnerabilities to be introduced into the plant.

Specifically, the assumption, that breakers required by TS to be closed regularly for maintenance would remain open as the sole means of preventing spurious valve closures, introduced a vulnerability into safety-related systems.

A more thorough design review may have revealed this vulnerability and ultimately prevented the event from occurring by demonstrating the need for an alternate means of preventing spurious valve closure.

IV. Analysis of the event:

The Tennessee Valley Authority (TVA) is submitting this report in accordance with Title 10 of the Code of Federal Regulations (10 CFR) 50.73(a)(2)(v)(A), (B), and (D), as any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to shut down the reactor and maintain it in a safe shutdown condition, remove residual heat, or mitigate the consequences of an accident.

The safety function of HPCI is to assure that the reactor is adequately cooled to limit fuel cladding temperature in the event of a small break in the nuclear system and loss of coolant which does not result in rapid depressurization of the reactor vessel. The safety function of RCIC is to provide makeup water to the reactor vessel during shutdown and isolation from the main heat sink to supplement or replace the normal makeup sources and operate automatically in time to obviate any requirement for the Core Standby Cooling Systems. Because the suction source was isolated, HPCI and RCIC were unable to perform their safety functions.

DCN 69786 was implemented on September 13, 2010, and changed the configuration of the breaker from normally closed to normally open to address fire concerns. This required a subsequent change in surveillance procedure 3-SR-3.5.1.2 (HPCI), which added the requirement for Operations personnel to close the breaker in order to verify the valve position. It was assumed during the design change process that the breakers for this isolation valve would remain open at all times, eliminating the requirement for redundant measures against spurious valve closure. The impacts of assumptions made by previous design changes were inadequately addressed; therefore, the design review for DCN 69786 was inadequate, which allowed latent design vulnerabilities to be introduced into the plant.

V. Assessment of Safety Consequences

This event resulted in inoperability and unavailability of the single trains of the BFN, Unit 3, HPCI and RCIC systems resulting in the inability of the HPCI and RCIC systems to perform their safety functions for shutting down the reactor and maintaining it in a safe shutdown condition, mitigation of the consequences of an accident, and the removal of residual heat in the event that the reactor was shut down.

Several alternate methods were available to Operations personnel in the event of an emergency to provide core cooling, safe and sustainable shutdown of the reactor, residual heat removal, and mitigation of accident consequences. Cross-tie valves allowed for taking HPCI and RCIC suction from four other available CSTs. The ability to align HPCI suction to the Unit 3 suppression pool was also present.

For Design Basis Accidents, in the event of inoperability of HPCI and RCIC systems due to lack of a suction source, adequate core cooling is ensured by the operability of the other low pressure ECCS injection/spray subsystems in conjunction with the ADS.

BFN Unit 3 Operations logs were reviewed to determine if ADS or the low pressure ECCS were inoperable during the time period of the HPCI system inoperability. The results of the review are as follows.

• For ADS, all ADS valves were operable during the time period and ADS initiation capability was maintained during this time period.

• For the low pressure ECCS subsystems, i.e., two Core Spray [BM] subsystems and two Low Pressure Coolant Injection [BO] subsystems, all low pressure ECCS subsystems were operable during the time period. Low pressure ECCS initiation capability was also maintained during this time period. With HPCI and RCIC inoperable, operable low pressure ECCS subsystems and ADS are capable of providing adequate core cooling in the event of a design basis accident or transient.

Based on the above, during the time period that the HPCI and RCIC systems were inoperable, sufficient systems were available to provide the required safety functions to protect the health and safety of the public. Therefore, TVA has concluded that there was no significant reduction to the health and safety of the public or plant personnel for this event.

A. Availability of systems or components that could have performed the same function as the components and systems that failed during the event:

During this event, all other ECCS and ADS systems remained operable.

B. For events that occurred when the reactor was shut down, availability of systems or components needed to shut down the reactor and maintain safe shutdown conditions, remove residual heat, control the release of radioactive material, or mitigate the consequences of an accident:

This event did not occur when the reactor was shut down.

C. For failure that rendered a train of a safety system inoperable, an estimate of the elapsed time from discovery of the failure until the train was returned to service:

This event resulted in inoperability of the BFN, Unit 3, HPCI and RCIC systems for approximately four minutes from the time the isolation valve was isolated until the isolation valve was remotely opened.

VI. Corrective Actions

Corrective Actions are being managed by TVA's corrective action program under Problem Evaluation Report 988444.

Interim Corrective Actions

1. Removed thermal overload heaters from isolation supply valve breakers 3-BKR-2-166, 1-BKR-2-170, and 2-BKR-2-162 to prevent valve closure when breaker is closed for valve position verification.

2. Repaired faulty hand switch 3-HS-2-166B.

Corrective Actions To Reduce Probability of Similar Events Occurring in the Future

The following corrective actions reduce the likelihood of recurrence:

1. System Engineering Supervisors to review 15 engineering change packages, chosen based on risk and complexity, which were implemented between January 2010 and December 2014 for quality of the Design Review. Provide feedback where strengths or gaps are identified. Initiate Service Requests for any conditions adverse to quality or potential adverse trends.

2. Issue engineering change packages for all three BFN units to prevent spurious operation of CST isolation valves while allowing Operations personnel to close the CST isolation valve breakers each month for valve position verification as required by surveillance procedures 1/2/3-SR-3.5.1.2, ECCS Monthly Valve Position Verification, and 1/2/3-SR-3.5.3.2, RCIC System Monthly Valve Position Verification.

VII. Additional Information:

A. Previous similar events at the same plant:

A search of Licensee Event Reports and corrective action program documents revealed that no similar events are known to have occurred at any BFN unit over the past three years.

B. Additional Information:

There is no additional information.

C. Safety System Functional Failure Consideration:

This event resulted in the inability of the BFN, Unit 3, HPCI and RCIC systems to perform their safety functions for safe and sustainable shutdown of the reactor, mitigation of the consequences of an accident, and removal of residual heat in the event that the reactor was shut down. In accordance with NUREG-1022, this event is considered a safety system functional failure.

D. Scram with Complications Consideration:

This event did not result in a reactor scram.

VIII. COMMITMENTS

There are no new commitments.