Semantic search

On November 1, 2017, at approximately 1425 Central Daylight Time, during an extent of condition review, a 4kV Shutdown Boards (SD BD) do not selectively coordinate with upstream 0.5 amp primary fuses for fault currents greater than 30 amps on the 120 V secondary. Cable fire damage could cause an affected SD BD to spuriously disconnect from off-site power, and could cause a spurious, maintained under-voltage trip signal. The under-voltage trip signal would prevent motor load operation on the board whether on off-site 4kV SD BDs could be affected. In fire area 21, 4kV SD BDs 3EA and 3EB could be affected.

This condition was determined to be a legacy issue dating to the original design of the plant. The most likely cause is lack of rigorous oversight of the vendor during the preparation and subsequent issuance of the fuse evaluation for the four Unit 3 4kV SD BDs. The required coordination studies have since been performed and a vendor oversight process has been added to TVA procedures. Compensatory measures (hourly fire watches) have been put in place for affected fire areas. Additional corrective actions include issuing an Engineering Change Package to replace the Unit 3 4kV SD BDs primary 0.5 amp PT fuses with 1 amp fuses of the same type.

During a surveillance test on June 8, 2016, the BFN, Unit 3, High Pressure Coolant Injection (HPCI) Turbine Stop Valve Mechanical Trip Valve behaved erratically upon turbine start. Troubleshooting and maintenance on the valve led to discovery of a condition that could have resulted in the HPCI system being unable to perform its required safety function in a Mode where HPCI Operability was required.

The inoperability was caused by the HPCI Turbine Stop Valve Mechanical Trip Valve's Reset Spring, which was deformed and weakened from years of continuous compression. The spring was replaced and the system was returned to service on June 10, 2016.

Corrective actions to prevent recurrence include revising preventive maintenance procedures to specify replacement of the Trip Tappet, Piston, and Reset Spring on a defined periodicity. Additionally, procedures will be revised to require testing the as-left breakaway force a minimum of three times to ensure repeatability.

Preventative maintenance procedures will also be revised to clarify that lift force checks after spring compression adjustments shall be conducted with the auxiliary oil pump running.

On April 6, 2016, the Tennessee Valley Authority was presented with as-found testing results indicating that three of the thirteen Main Steam Relief Valves (MSRVs) from Browns Ferry Nuclear, Unit 3, exceeded the +1- 3 percent setpoint required for their operability. Troubleshooting determined that the MSRV discs failed by corrosion bonding to their valve seats. The valve discs were previously platinum coated to prevent this, but the valve seat's rough Stellite surface caused the coating to flake off.

It was determined that the MSRVs were inoperable from March 19, 2014 to February 20, 2016. The affected valves remained capable of maintaining reactor pressure within American Society of Mechanical Engineers code limits. Additionally, the valves' ability to open under remote-manual operation, or activation through the Automatic Depressurization System or MSRV Automatic Actuation Logics was not affected. The valves remained capable of performing their required safety function.

Corrective Actions were to replace all Unit 3 MSRVs, to analyze the pilot valves of the inoperable MSRVs, and to revise procedures to verify the pilot disc finish meets its requirements prior to valve assembly.

On February 22, 2016, during routine maintenance of the Browns Ferry Nuclear, Unit 3 Core Spray (CS) system, relays on the 3ED 4kV Shutdown Board were found de-energized. This resulted in loss of the automatic start function of the 3B and 3D CS Pumps, the 3D Residual Heat Removal (RHR) pump, and the D1 Residual Heat Removal Service Water (RHRSW) pump, with normal power to the 3ED 4kV Shutdown Board.

Troubleshooting determined the relay was de-energized due to a failure of the 6-6C contacts on the MJ(52STA) switch associated with the 3ED 4kV Shutdown Board, and a binding of the 52STA Cam Linkage. This was caused by a misalignment of the switch to linkage interface, due to improper installation. The switch was subsequently replaced. Alignment verification instructions will be added to switch replacement procedures.

The duration of inoperability the 3B and 3D CS pumps, 3D RHR pump, and D1 RHRSW pump, was determined was placed in Mode 4. Manual start of these pumps remained available. Automatic start capability of the other Unit 3 CS, RHR, and RHRSW pumps was unaffected by this condition, and the required safety functions of the impacted systems continued to be met.

On August 20, 2015, at 1032 Central Daylight Time (CDT), while installing test equipment on the 3ED 4kV Shutdown Board (SD BD), for an online dynamic motor test of the 3D Residual Heat Removal pump motor, the Unit 3 Control Room received degraded voltage alarms and under voltage alarms for the 3ED SD BD. The 3ED 4kV SD BD normal feeder breaker opened, and the 3D Emergency Diesel Generator (DG) fast started and tied onto the board.

Troubleshooting was performed on the 3ED SD BD and on the 3D DG. The failure mode for this event was the clearing of primary and secondary 3ED SD BD metering fuses. The normal feeder breaker was closed, and offsite power to the SD BD was declared operable on August 21, 2015, at 1945 CDT.

A definitive cause could not be identified for the clearing of the fuses. However, corrective actions will be implemented that will address all of the most probable causes, and will minimize the likelihood of recurrence. These actions include performing inspections on circuits used for online dynamic motor testing of motors, removing the potentially faulty test equipment from service, and removing online dynamic motor testing from 4kV motor preventative maintenance.

On January 22, 2015, the Browns Ferry Nuclear Plant (BFN), Unit 3, the 3D Core Spray Pump normal power relay (3-RLY-075-14A-K31B) was found de-energized when it should have been energized during performance of a surveillance. Troubleshooting determined the cause of the relay being de-energized was failure of the MJ(52STA) switch in the associated breaker. The relay is an emergency start permissive for the 3B and 3D Core Spray pumps, the 3D Residual Heat Removal pump, and the D1 Residual Heat Removal Service Water pump. This condition prevented those systems from automatically performing their safety functions under normal power, rendering them inoperable for longer than allowed by Technical Specifications. However, these systems were available and the affected pumps could be manually started to perform their safety functions in the event of an accident. The failed switch only serviced the normal power feed, and automatic starting function was unaffected under emergency power. On February 18, 2015, an engineering evaluation determined the switch had apparently failed on September 17, 2014. On January 24, 2015, the relay and switch were replaced, and the automatic startup function was restored.

Apparent causes of the event are failure to implement all appropriate preventive maintenance or pre-emptive replacement allowing MJ(52STA) switches to fail, and the BFN Breaker Program excluding the associated switchgear components allowing support components to be overlooked with respect to reliability.

Corrective actions include replacing MJ switches in non-spare breakers and revising associated preventive maintenance, and revising the Breaker Program to include essential switchgear components.

On February 11, 2015, at 0820 Central Standard Time, Brown's Ferry Nuclear Plant (BFN), Unit 3, declared the High Pressure Coolant Injection (HPCI) and Reactor Core Isolation Cooling (RCIC) systems inoperable due to no suction source aligned. During surveillance testing, the Condensate Storage Tank (CST) emergency discharge isolation valve energized and closed when the breaker was closed, isolating both systems from their suction source. It was subsequently determined that contacts on the local hand switch were stuck closed following performance of a previous maintenance task. Operations personnel re-opened the isolation valve using the hand switch in the Control Room, restoring operability to the HPCI and RCIC systems.

The apparent cause of this event was inadequate design review of a 2010 plant modification which allowed latent design vulnerabilities to be introduced into the plant.

The corrective actions to reduce the probability of a similar event occurring in the future were to remove thermal overload heaters from the affected breakers, preventing valve closure when these breakers are closed; to review a sample of recent engineering change packages for quality of Design Review; to repair a faulty hand switch; and to implement a design change for the CST isolation valves for all three BFN units to prevent spurious operation of the isolation valve when the associated breaker is closed.

On May 6, 2014, at approximately 0830 Central Daylight Time (CDT), the Browns Ferry Nuclear Plant (BFN) Unit 3 reactor automatically scrammed as a result of an Anticipated Transient Without Scram/Alternate Rod Insertion (ATWS/ARI) signal generated during functional testing of reactor water level instrumentation. The scram air header was depressurized through the ATWS/ARI valves causing all rods to insert into the core. The ATWS/ARI signal also simultaneously opened the Recirculation Pump Trip (RPT) breakers, tripping both Recirculation pumps. The loss of both pumps along with reduced core flow caused a reactor water level transient that lowered level below the Reactor Protection System (RPS) trip setpoint (+2 inches), resulting in a full reactor scram signal.

Prior to this event, reactor power was 2.1 percent as all control rods were inserted by the ATWS/ARI initiation ten seconds earlier. Following receipt of the ATWS/ARI signal, all plant systems performed as required.

The root cause of the event was that the ATWS low reactor water level Automatic Trip Unit (ATU) cards initiated a voltage transient that actuated the ATWS high reactor pressure trip due to a design anomaly.

The corrective action to prevent recurrence includes installing time delay relays in association with the Unit 3 reactor pressure ATWS circuit.

On February 25, 2013, at approximately 1313 hours Central Standard Time, the Browns Ferry Nuclear Plant (BFN), Unit 3, reactor automatically scrammed due to an actuation of the Reactor Protection System from a turbine trip. The turbine tripped on low condenser vacuum due to a reactor feedwater piping separation. The Main Steam Isolation Valves were manually closed. There was one Safety Relief Valve that was manually operated to maintain reactor pressure due to the unavailability of the Main Turbine Bypass Valves upon loss of condenser vacuum. All systems responded as expected to the turbine trip. No Emergency Core Cooling System or Reactor Core Isolation Cooling (RCIC) system reactor water level initiation set points were reached. Reactor water level was controlled with the RCIC system and reactor pressure was controlled with the High Pressure Coolant Injection system.

The root cause for this event is that the system design for BFN, Unit 3, Feedwater Long Cycle line does not account for flashing of water to steam due to isolation valve leakage.

The corrective action to prevent recurrence is to redesign Feed Water Long Cycle lines downstream of each Feed Water Long Cycle isolation valve and upstream of the Miscellaneous Drain Header with a valve and piping configuration appropriately designed for the specified application.

On January 9, 2013, at 0400 Central Standard Time, an Auxiliary Unit Operator (AUO) performing rounds near the 3D Emergency Diesel Generator (EDG) discovered metal residue around the blower shaft. Inspection by Maintenance determined the blower bearing had failed.

Operations declared the 3D EDG inoperable.

The root causes of this condition are the shielded bearings in the EDG blowers were not adequately assessed on a component level to identify potential failure modes and impacts to EDG operability, and standard vibration data was ineffective in identifying the degradation of the lubrication in the shielded bearings of the BFN, Unit 3, EDG blowers due to the masking effect of generator vibrations.

Immediate corrective actions included the inspection and replacement of all diesel blower bearings that had not been replaced since 2012. The corrective actions to prevent recurrence are to determine appropriate Preventive Maintenance strategies for the population of sealed or shielded bearings associated with EDGs and safety or quality related rotating equipment, and to add an additional vibration monitoring point to the EDG blower fan bearings and relocate two existing monitoring points to the drive end bearing housing.

I I I

On May 24, 2012, at approximately 0638 Central Daylight Time, Operations personnel inadvertently ranged 3H intermediate range monitor (IRM) down instead of up resulting in a half scram from the 3B reactor protection system (RPS) trip channel. Subsequently, the IRM was properly ranged and Operations personnel responded in accordance with procedures to reset the half scram. Coincident with Operations personnel placing the scram reset switch in the Group 2/3 position, an electrical spike was received on 3A IRM of the 3A RPS trip channel resulting in control rod insertion for the Groups 1 and 4 control rods. Operations personnel identified the unexpected control rod motion and initiated a manual reactor scram in accordance with Browns Ferry Nuclear Plant (BFN) Abnormal Operating Instructions.

The root cause was determined to be high impedance of the BFN, Unit 3, Main Control Room (MCR) common ground to station ground that exposed the 3A IRM to noise feedback.

The corrective action to prevent recurrence is to verify that BFN, Unit 3, MCR common ground connections to station ground are as shown in the applicable system drawings. If any ground connections are identified that require repair, work orders will be initiated and repairs performed.

Following repairs, the high impedance connection of BFN, Unit 3, MCR common ground to station ground will be confirmed to have been resolved by documenting the results of validation testing.

On December 26, 2010, at 1615 hours Central Standard Time, an alarm for Main Turbine Vibration High 3-VA-47-15 was received in the Unit 3 control room on annunciator panel 3-XA-55-7B Window 32.

Control room operators responded using Unit 3 Alarm Response Procedure (ARP) 3-ARP-9-7B. Exciter rotor inboard journal bearing vibration level indicated 8.0 mils and rising, and the outboard journal bearing indicated 5.5 mils and rising. At 1617 hours, an Upper Power Runback was initiated per the ARP. It was noted that vibration levels initially lowered then continued rising. At 1620 hours, control room operators initiated a manual reactor scram.

The direct cause of this event was an exciter rotor-deflector rub resulting from a combination of high differential air exit temperatures and existing decreased clearances on the rotor. The root cause was inadequate procedural guidance for monitoring the exciter air cooling system and prescribing mitigation actions to be taken based on differential temperature limits.

The rub was corrected during the forced outage. Corrective actions include installation of cooler vents for use in minimizing air binding, establishment of a cooler venting process, increased controls and documentation of manual "balancing" valve manipulation, increased system monitoring process rigor and oversight, and performance of a training analysis for inclusion of relevant aspects of this root cause into the Operations and Engineering training materials.

On February 13, 2007, and again on August 26, 2009, during post-scram reviews, Browns Ferry Nuclear Plant personnel identified an unexpected level of instability in the Reactor Core Isolation Cooling (RCIC) system flow and turbine response following reactor scrams that occurred on February 9, 2007, and on August 24, 2009. Following each event, site engineering personnel reviewed the RCIC response and concluded the RCIC system was capable of performing its design function and Operations determined that RCIC was operable. On February 12, 2007, and again on August 26, 2009, Unit 3 entered Mode 2, commencing startup operations. Following the second event on August 24, 2009, Unit 3 was returned to service and remained at power until September 12, 2009, when Unit 3 was removed from service for scheduled maintenance activities.

During the September 2009 outage, the RCIC Electric Governor-Remote (EG-R) was replaced and I successfully tested. On March 25, 2010, in response to questions from the Nuclear Regulatory Commission (NRC), the Tennessee Valley Authority notified the NRC via a conference telephone call I that Unit 3 RCIC was inoperable since March 22, 2006, after the EG-R had been installed and when Unit 3 exceeded 150 psig while in Mode 2. This reflected RCIC inoperability longer than allowed by Technical Specification 3.5.3 and mode changes not allowed by LCO 3.0.4. A failure analysis, conducted by Engine Systems Incorporated, determined the oscillations were caused by a missing buffer piston and springs within the EG-R.

On November 30, 2007, at approximately 1052 hours Central Standard Time (CST), during the process of shutting down for a planned maintenance outage, Operations isolated the Unit 3 High Pressure Coolant Injection (HPCI) steam supply, with the reactor at 950 psig. Operations verified by administrative means that the Reactor Core Isolation Cooling system and two Control Rod Drive system pumps were available as a high pressure injection water source, and entered Technical Specification Limiting Condition for Operation (LCO) 3.5.1.C. A previously identified steam leak on the packing of the HPCI steam line condensate inboard drain valve had increased. This leak was identified prior to entering the maintenance outage and plans were in place to remove HPCI from service and repair the leak. However, because the volume of the leak increased, operations removed HPCI from service earlier than planned. LCO 3.5.1.0 was exited at 1435 hours CST when the reactor pressure was less than 150 psig.

TVA is submitting this report in accordance with 10 CFR 50.73(a)(2)(v)(B) and 10 CFR 50.73(a)(2)(v)(D) as "any event or condition that could have prevented the fulfillment of a safety function of structures of systems that are needed to: Remove residual heat or mitigate the consequences of an accident.

On July 24, 2007, at 1645 hours central daylight time (CDT) the Unit 3, Division II Emergency Core Cooling Systems (ECCS) Analog Trip Unit (ATU) Inverter failed due to a cleared fuse during a 250 VDC Reactor Motor Operated Valve (RMOV) board power supply transfer. The inverter provides power to the High Pressure Coolant Injection (HPCI) pump discharge flow controller. WA declared HPCI inoperable and entered a fourteen day Technical Specification (TS) Limiting Condition for Operation (LCO). Following fuse replacement at 2318 hours, Unit 3 HPCI was declared operable and the fourteen day LCO was exited. The fuse cleared due to an overcurrent condition during the power supply transfer. The transfer was performed with the inverter in service. The probable cause for the fuse clearing was a voltage transient on the ECCS inverter during the 250 VDC RMOV Board power supply transfer that resulted in a higher than normal inrush current across the input fuse. WA will revise the operating instructions to require the affected ECCS ATU Inverters de-energized prior to a scheduled transfer of the input voltage source.

Because HPCI was inoperable during the timeframe the inverter was out of service, WA is submitting this report in accordance with 10 CFR 50.73(a)(2)(v)(B) and (D) as; any event or condition that could have prevented the fulfillment of the safety function of structures or systems that are needed to: remove residual heat; and to mitigate the consequences of an accident.

On August 29, 2006, while in steady state operation at 100% power, control room annunciation was received at 2210 hours CDT of a low level in the main turbine electro-hydraulic control (EHC) fluid reservoir. Local inspection of the tank confirmed an actual low level and also that the tank level was continuing to drop. At 2223 hours, reactor power was reduced to approximately 78% via reactor recirculation pump speed reduction, and, at 2225 hours, a manual scram was initiated in accordance with plant procedures. All control rods fully inserted and expected system responses were received. Actuation of primary containment isolation system groups 2, 3, 6, and 8 occurred due to the expected temporary lowering of reactor water level below the actuation setpoint. Valve realignment as part of the main turbine trip which followed the scram isolated the location of the EHC fluid leak from the rest of the system. The normal heat rejection path (from the reactor to the main condenser via the main steam lines with reactor water make-up provided by the condensate/feedwater systems) remained in service.

Reactor water level was recovered to the normal operating range by the normal reactor water level control system. Neither the high pressure coolant injection nor reactor core isolation cooling systems were used during this event.

The root cause of the EHC fluid leak was determined to be inadequate 0-ring compression on a solenoid valve mounting due to the use of device mounting bolts which were too long. The bolts and the valve were supplied as a kit by the vendor. Plant procedures will be revised to verify bolt length and mounting hole depth in future activities involving EHC components.

Following testing of main steam relief valves (MSRV) removed from Unit 3, it was discovered that 2 of the 13 Technical Specifications Limiting Condition for Operation (LCO) 3.4.3 requires that 12 MSRVs be operable in reactor modes 1, 2, and 3. If less than 12 MSRVs are operable, then the unit is to be placed into Mode 3 within 12 hours and Mode 4 within 36 hours. Since each BFN unit has 13 installed MSRVs, the inoperability of more than 1 MSRV would require the above actions to occur. While the setpoint-drift condition was not identified until after the valves' removal from the plant, MSRV pilot valve disc-seat corrosion bonding in boiling water reactor applications is a known phenomenon, and the condition is deemed to have developed while the valves were in service during Unit 3 Cycle 12 operation.

The root cause of this condition was MSRV pilot valve disc-seat corrosion bonding which can develop during normal reactor operations. The affected valves will be refurbished and their lift-setpoints re-established prior to reinstallation in the plant. There were no actual safety consequences associated with this event.

On 9/17/05 Unit 3 was in steady state operation at approximately 73% power. A maintenance activity was in progress to repair a level control valve on a high pressure feedwater heater. During the work on the valve, an air in-leakage pathway to the main condenser was created, and due to an unanticipated mechanical failure of the valve internals, the valve could not be readily reassembled to isolate the in-leakage path. Over a period of approximately 10 minutes, the main condenser vacuum decreased to the low vacuum trip setpoint for the main turbine, and a main turbine trip and subsequent reactor scram occurred at 1129 hours CDT. All expected system responses occurred. Actuation of primary containment isolation system Groups 2, 3, 6, and 8 occurred due to the expected temporary lowering of reactor water level below the actuation setpoint. This logic isolates shutdown cooling (if in service), isolates the reactor water cleanup system, isolates the normal reactor building ventilation, initiates the standby gas treatment system, initiates the control room emergency ventilation system, and retracts traversing incore probes (if inserted). The normal heat rejection path (from the reactor to the main condenser via the steam lines with reactor water make-up provided by the condensate/feedwater systems remained in service.

Neither the high pressure coolant injection nor reactor core isolation cooling systems were used during this event.

No safety-relief valve (SRV) operation occurred during the trip transient, and post-trip review confirmed that peak reactor pressures remained below the nominal SRV lift setpoints.

The event was caused by the unanticipated failure mode of the valve's internals, and the work control process was not effectively managed to assess all possible failure modes. Corrective actions include revisions to operating procedures and the provision of training to managers/supervisors on effective operational decision making.