REPORT

WANO REPORT

RPT 2015-3 May 2015

Age-Related Degradation of Electronic
Equipment

LIMITED DISTRIBUTION
This page is left blank intentionally
LIMITED DISTRIBUTION WANO RPT 2015-3

APPLICABILITY

THIS WANO REPORT APPLIES TO ALL REACTOR TYPES

LIMITED DISTRIBUTION

Confidentiality notice
Copyright 2015 by the World Association of Nuclear Operators (WANO). All rights reserved. Not for sale or commercial use. This document is protected as an
unpublished work under the copyright laws of all countries which are signatories to the Berne Convention and the Universal Copyright Convention. Unauthorised
reproduction is a violation of applicable law. Translations are permitted. This document and its contents are confidential and shall be treated in strictest confidence. In
particular, except with the prior written consent of the WANO Chief Executive Officer, this document shall not be transferred or delivered to any third party and its
contents shall not be disclosed to any third party or made public, unless such information comes into the public domain otherwise than in consequence of a breach of
these obligations.

Liability disclaimer notice

This information was prepared in connection with work sponsored by WANO. Neither WANO, Members, nor any person acting on the behalf of them (a) makes warranty
or representation, expressed or implied, with respect to the accuracy, completeness, or usefulness of the information contained in this document, or that use of any
information, apparatus, method or process disclosed in this document may not infringe on privately owned rights, or (b) assumes any liabilities with respect to the use
of, or for damages resulting from the use of any information, apparatus, method, or process disclosed in this document.

WWW.WANO.ORG i
LIMITED DISTRIBUTION WANO RPT 2015-3

Report RPT 2015-3

Revision History

Author Date Reviewer Approval

Samvel Ghazaryan 22 May 2015 Michael Ballard Jo Byttebier

Reason for Changes:

WWW.WANO.ORG ii
LIMITED DISTRIBUTION WANO RPT 2015-3

REPORT RPT 2015-3

Age-Related Degradation of Electronic Equipment

CONTENTS
Age-Related Degradation of Electronic Equipment 2
Purpose 2
Background 2
Summary 2
Analysis of the Operating Experience Events 4
Results from OE Event Review 6
WANO Peer Review Results Related to Ageing of Electronic Equipment 9
Conclusions and Key Lessons Learned 11
References 13
Attachment 1 14
Electronic Equipment Ageing Related Events Reported to WANO 14
Attachment 2 19
Examples of Electronic Equipment Failures 19
Attachment 3 22
Ageing Management Strength from Benchmarking 22

WWW.WANO.ORG 1
LIMITED DISTRIBUTION WANO RPT 2015-3

REPORT RPT 2015-3

Age-Related Degradation of Electronic Equipment

Purpose

This report discusses age-related degradation of three electronic component types:

circuit cards

capacitors

relays

The analysis is based on operating experience reports submitted to WANO, and areas for improvement
(AFIs) identified during WANO Peer Reviews (PR) in the period 2012-2014.

This report presents key lessons learned that can be used by the WANO members to benchmark or assess
experiences and practices in their own stations. The report can also be used by WANO when conducting
technical support missions related to ageing electronic equipment.

Background

The nuclear industry is facing ageing issues with electronic equipment installed in instrumentation and
controls for systems that support nuclear safety and plant reliability. Based on WANO event reports,
electronic equipment are experiencing ageing-induced failures mainly in circuit cards (the term circuit
card or card refers to both circuit cards and circuit boards), capacitors and relays. These failures have
caused reactor scrams and plant transients but have also caused malfunction or inoperability of safety-
related components.

Attachment 1 provides the event reports considered in this report. Attachment 2 outlines examples of the
more important electronic equipment problems, and Attachment 3 presents an example of a strong ageing
management programme that was identified during international benchmarking.

Summary

Weaknesses in equipment reliability management are the leading contributors to these age-related events.
Example weaknesses include not solving repetitive equipment problems, insufficient development of
preventive strategies and inadequate implementation of proactive life cycle plans. In many events,
electronic components were operated until they failed and reactive actions were then taken to improve
reliability.

Vendor identified life expectancy limitations for safety-related electronic components are not always
respected due to equipment qualification programme weaknesses and lack of comprehensive maintenance
programmes for replacing ageing or obsolete electronic devices in a timely manner.

Accelerated ageing often occurs in electronic components when installed in a high temperature
environment. The failure rate increases with power plant age as seen in Figure 2. Strategic planning is
needed to ensure spare parts are available since the original manufacturer may no longer supply
replacements.

WWW.WANO.ORG 2
LIMITED DISTRIBUTION WANO RPT 2015-3

The following sections summarise factors for improving the reliability of circuit cards, capacitors and relays.
See the Conclusion and Key Lessons Learned section for additional detail.

Circuit Cards

A typical strategy for mitigating circuit card failure is periodic replacement with the same make and model,
if equivalent spares are available from the vendor or in the warehouse. Where the card type was obsolete
and unavailable, a few stations tried refurbishing the cards. The refurbishment strategy was unsuccessful at
several stations as high quality refurbishment of the card was difficult if the original design information
(diagrams and subcomponent specifications) was not available. The refurbishment vendor would replace
only the failed subcomponents without replacing other subcomponents on the card susceptible to ageing;
therefore, the card would be reinstalled only to fail again soon after as the result of other part failures.

Other stations developed or purchased circuit card testing equipment. Installed cards would be removed
from station racks or panels and periodically tested. However, frequent or improper circuit card handling
and wear on the contact edges from removal and reinstallation can degrade the card over time. Therefore,
it is important that inspections of the card edge connector and cabinet receptacle are performed any time
a circuit card is removed/installed.

Some circuit cards have a vendor recommended operating temperature range. Installation of forced
ventilation from small fans in the racks or cabinets can prolong the life of circuit cards and maintain cards
below the temperature limit.

Metal whisker formation is one degradation mechanism observed on circuit cards and relays. Whiskers
are tiny, thin straws of zinc which grow from zinc coated metal surfaces and can cause short circuits.
Growing whiskers across the contacts and subcomponents can result in failure. Some stations perform
inspection of selected components under high magnification with sufficient lighting. Electronic components
that were manufactured in adherence to the Restriction of Use of Hazardous Substances directive RoHS 1
can be more susceptible to whisker formation. In these cases, an enhanced metallic whisker inspection and
cleaning process should be considered for these cards.

It is important that proper equipment and techniques are used to prevent inadvertent circuit card damage
caused by electrostatic discharge (ESD) during circuit card handling and maintenance activities (for
example, card testing in a maintenance shop and handling of a card in the warehouse). One reference for
establishing an ESD preventive program is ANSI/ESD-S20.20-2007.

A strength identified during a WANO Peer Review discusses one station that significantly reduced their
circuit card failure rate by implementing industry best practices. See details in the WANO Peer Review
Results Related to Ageing of Electronic Equipment section.

Capacitors

Electrolytic capacitors have a specific lifespan (around 10 years depending on the vendor recommendations
and the environmental conditions of the installed capacitor). Periodic replacement is the typical preventive
strategy. The challenge is to know where the electrolytic capacitors are installed. The capacitors typically do
not have a unique station equipment identification and are often a subcomponent in a larger piece of
equipment such as an inverter, controller, circuit card or some type of critical control system. Detailed
review of electrical components is needed when classifying equipment as critical or non-critical, to identify
failure modes based on internal subcomponent ageing so that actions can be planned to prevent failures.

1
Environmental directive restricting use of certain hazardous substances (such as lead) in electrical and electronic equipment,
initiated in February 2003 by the European Union.

WWW.WANO.ORG 3
LIMITED DISTRIBUTION WANO RPT 2015-3

Electrolytic capacitors also have limited shelf life. The manufacturing date of spare capacitors should be
known and tracked. Periodic preventive replacements must account for both time in storage and time in
service. Some plants limit the period that a capacitor is allowed to be in stock (such as less than 18 to 24
months). Electrolytic capacitor shelf life can be improved by reforming it. The process of reforming an
electrolytic capacitor consists of applying rated voltage, through a resistor, for a certain period (such as five
minutes plus one minute per month of storage). This can vary based on vendor recommendations.

Changes in electrolytic capacitor manufacturing over the years have resulted in capacitors being
manufactured closer to their actual rating than in previous years. Due to the wide allowable tolerance
range on these types of capacitors (-10% to +50%), preventive maintenance replacement with the newly
manufactured capacitors may result in an unexpected change in capacitance that can adversely affect
equipment operation. One plant reduced the replacement frequency from 10 years to no more than seven
years for safety-related applications.

Some research states that degradation of an electrolytic capacitor is directly tied to the increase in the
equivalent series resistance (ESR) measurement of the capacitor. It also states that when a capacitor
reaches 2.8 times the base value of the ESR, it should be replaced.

Capacitor electrical tests that can detect degraded conditions include capacitance measurement,
dissipation factor test, working voltage test, leakage current test, temperature cycling screening and ESR
measurement testing.

Relays

There are many relay types, manufacturers and applications. The life expectancy also varies widely. Some
relays may last the life of the plant while other relays may have a finite life based on application (normally
energised or de-energised), service conditions and ambient environment (heat, humidity, radiation field).
While research on the expected life of relays is ongoing, stations should use industry and station operating
experience and vendor recommendations for establishing preventive strategies.

By trending relay failures at the system level and causes at the subcomponent level (for example, contacts,
coils and terminations), stations can proactively implement preventive actions when degrading trends are
evident.

Typical preventive or monitoring strategies include thermography, calibration, functional testing and
periodic replacement. Thermal signature analysis, contact resistance measurement or evaluation of
response time can also be used for early detection of relay ageing.

Analysis of the Operating Experience Events

Ninety-three electronic equipment age-related operating experience (OE) event reports were extracted
from the WANO OE database for the selected three-year period (2012-2014). The events included age-
related failures in 38 circuit cards, 28 relays and 27 capacitors. The WANO database WANO Event Report
(WER) number and title of these OE event reports are shown in Attachment 1. Some representative
examples of age-related events are included in Attachment 2.

Figure 1 shows the consequences for these 93 events in four categories: reactor scram, power reduction,
negative safety system impact and other.

WWW.WANO.ORG 4
LIMITED DISTRIBUTION WANO RPT 2015-3

Figure 1. Consequences of Electronic Equipment Age-Related Events

Other Scram
7% 16%

Power
Safety System Impact Reduction
58% 19%

About 58% of the age-related OE events reported to WANO involved negative impact to safety-related
systems while 16% (15 events) resulted in either an automatic or a manual reactor scram.

Figure 2 presents a distribution of the electronic equipment age-related OE events in relation to the
commercial start date of the units experiencing the event. As expected, there is an increase in events with
increasing age of the plants.

Approximately 82% of the units that experienced events initiated by electronic equipment age-related
problems during the last three-year period had commercial start dates in or before 1990 and were in
operation for more than 25 years.

Figure 2. Number of Ageing Related Events on Electronic Equipment as a Function

of Reactor Commercial Start Date
18
17
16 16
14 14 14
Number of Events

12
10
8 8
6
5
4 4
3 3
2
1
0 0
1985 and before 1986 -1990 1991-1995 1996 and later
Circuit cards 16 14 5 3
Relays 17 8 3 0
Capacitors 14 8 1 4

WWW.WANO.ORG 5
LIMITED DISTRIBUTION WANO RPT 2015-3

Results from OE Event Review

The following section provides additional discussion of the ageing aspects of each of the three electronic
components selected for the analysis.

Circuit Cards Trends and Observations

The cause of most circuit card event reports was attributed to ageing, but some contained uncertainty of
the root cause or indicated that further analysis was required.

Failures of instrumentation and control systems due to ageing of circuit cards had an immediate negative
impact on plant reliability and availability.

Of the 38 circuit card age-related events, 18 occurred in safety-related systems. Four of these resulted
in safety system degradation and an entry into technical specification limiting conditions for operation.
The remaining 14 events resulted in reduction of safety system redundancy and safety margins.
Systems affected included reactor protection, auxiliary feedwater, emergency power, neutron flux
control and rod control. The safety system impacted the most by the card failures was rod control
(including drives and power supply). In one event, a failed circuit card caused a control rod to drop into
the reactor and misalignment of an additional control rod, resulting in forced power reduction.

Of the 20 events that challenged plant reliability, 11 events resulted in power reductions and two
caused outage extensions.

Five events resulted in either an automatic or a manual reactor scram. In one case, a turbine electro-
hydraulic control system card failure caused unexpected turbine control valve movement, reactor
vessel pressure increase and neutron flux spike. This resulted in an automatic reactor scram on high
average power range monitor flux. Four of the five degraded circuit cards were replaced with the
exception of one being obsolete without an available replacement.

Systems impacted the most by the card failures included turbine generator instrumentation and
control system, main feedwater, power supplies to vital instrumentation, control rod drive, and
reactor recirculation system (boiling water reactor). Circuit cards are often contained in a larger
component such as power supplies, battery chargers, amplifiers and controllers (speed, level and
flow).

Several events were initiated by circuit card failures in obsolete battery chargers caused by ageing. The
corrective actions for most of these events were to replace the obsolete chargers with new more
reliable units.

In three events, card degradation was from accelerated ageing attributed to inadequate design. For
example, excess thermal loads generated by the cards caused the degradation of the digital electro-
hydraulic control system. The area where the card was located reached temperatures close to 70C.
Lack of heat removal caused the electronic cards to overheat.

The cause of some events was identified as not having preventive maintenance (PM) in place to
periodically replace the cards. The safety-related circuit cards were not included in the ageing
management programme. In one event the integrated circuit card for level control became corrupted
during a minor power surge. The controller was in service beyond its expected life. In another
example, age-related failure on the reactor recirculation flow control system card occurred. Although
these circuit cards were classified as critical, no periodic replacement was required.

WWW.WANO.ORG 6
LIMITED DISTRIBUTION WANO RPT 2015-3

In five events, the cards were installed since plant start-up and in service for approximately 25-30
years. The original equipment manufacturer no longer supported this equipment therefore spares
were no longer available.

Capacitors Trends and Observations

Capacitors are energy storage devices that are widely used in electronic and electrical power circuits.
Electrolytic capacitor failures represent most of the consequential capacitor-related events that caused
reactor scrams and reduced the reliability of important and safety-related equipment.

The dominant ageing mechanism for electrolytic capacitors is loss of capacity. One of the observed
mechanisms for ageing was natural degradation of the capacitors solid and liquid insulation which caused
an earth fault. Ageing can cause the epoxy insulation to harden and crack over time. Capacitors may also
leak, drift, or make electronic noise, as a result of varying environmental conditions. Shifts in temperature
can be problematic for capacitors, resulting in premature circuit damage or malfunction. High temperature
and temperature cycling can reduce the capacitors life.

There were 27 capacitor age-related events found in the WANO OE database for the period 2012-2014.

Approximately 19 capacitor age-related events occurred in safety-related systems and resulted in

reduction of system redundancy and safety margins (systems included reactor protection and vital
power supply systems including diesel generator, emergency core cooling and core neutron
monitoring). In one instance, high pressure core injection pump breaker tripped and prevented the
pump from starting during surveillance testing. In another instance, high pressure core injection
inoperability was due to power supply inverter failure. The root cause was age-related degradation of
capacitors. In another event, 12 fast-acting scram system rods dropped into the core due to loss of the
primary and backup power supplies. The analysis discovered that the backup supply had a failed
thyristor module due to capacitor degradation.

For five events, the capacitor failures resulted in automatic or manual reactor scrams. Ageing of
aluminium electrolytic capacitor that were part of control modules and uninterruptible power supplies
were contributors.

Five other capacitor failures impacted plant reliability. Three events resulted in power reductions and
two events experienced outage extensions.

Systems impacted the most by capacitor ageing included AC and DC power supplies to vital
instrumentation, main turbine and emergency power supply.

In two events, there was a loss of capacitance over time (the capacitors were manufactured 30 years
ago). The capacitor leakage current was over the acceptable design value.

In one event, an installed capacitor failed after installation because the part had degraded during
storage. The shelf life of the capacitor was not considered when the replacement was made.

Several events showed that vendor manuals did not recommend inspection methods or specifications
for monitoring the capacitors. In one case, the vendor manual only mentioned that capacitors have a
long expected service life without considering service conditions and environmental factors.

Relays Trends and Observations

Relay parts which are vulnerable to ageing or affected by debris deposits include the coil, contacts
(oxidation or pitting) and elastomer components. Ageing of relay coil may be caused by heat, especially if
normally energised. The actual coil service life depends on ambient temperatures and operating times. In
time delay or undervoltage relays heat may cause embrittlement of the diaphragms and setpoint drift.
WWW.WANO.ORG 7
LIMITED DISTRIBUTION WANO RPT 2015-3

There were 28 relay age-related events found in the WANO OE database for the period 2012-2014.

Seventeen age-related relay events occurred in safety-related systems. Six were failed relays in
emergency diesel generator controls. Three relay failures resulted in safety system degradation and an
entry into technical specification limiting conditions for operation. The remaining eleven events
resulted in reduction of safety system redundancy and safety margins (systems such as auxiliary
feedwater, emergency power distribution, reactor power control, rod control and emergency core
cooling); for example, spurious start of turbine driven auxiliary feedwater pumps and emergency
diesel generator occurred due to sudden drop in voltage on the 6.6kV busbars. The common cause of
both events was degradation of undervoltage relays.

Seven events challenged plant reliability. For five events, the relay age-related failure initiated an
automatic or a manual scram. Other events resulted in power reductions and outage extensions.

In several events, the failed relays had been in service more than 25 years. There was no PM to
periodically refurbish or replace the relays.

In a few examples, station personnel did not review or implement industry OE, design or maintenance
recommendations issued by a vendor to mitigate relay ageing. For example, during normal operation
and while an emergency diesel generator was supplying a 4kV shutdown board as a part of post-
maintenance testing, reactor protection system motor generator set drive motor stopped due to
failure of a time delay relay. The relay was installed for approximately 13 years against a replacement
schedule of 10 years.

In four events, the causes and relay failure mechanisms were either undetermined or attributed at
normal wear/end-of-life and the relay was sent offsite for assessment. Corrective actions involved
calibration or replacement with an equivalent component and addition of the relays to the PM
programme.

In four events, relay replacement frequencies were not specified. Relays were not adequately
prioritised for testing or periodic replacement; for example, during an outage, the residual heat
removal shutdown cooling suction valve closed unexpectedly, resulting in loss of the decay heat
removal. The cause was the reactor protection system (RPS) sending a spurious signal to the valve due
to a failure of the relay coil in the RPS.

WWW.WANO.ORG 8
LIMITED DISTRIBUTION WANO RPT 2015-3

WANO Peer Review Results Related to Ageing of Electronic Equipment

Eleven areas for improvement (AFIs) and one strength involving electronic equipment ageing were
identified in WANO PRs since 2012. Two AFIs were reported in 2012, five in 2013, and four in 2014. Most of
the AFIs were in the WANO PO&C 2013-1, Performance Objectives and Criteria, ER.3 (Long-Term Equipment
Reliability) which relates to managing age-related degradation and maintaining long-term equipment
reliability.

The table below summarises the age-related AFIs from peer reviews.

Year Issue Type

2012 Ageing and obsolescence of electronic components within critical systems such as AFI
shutdown systems 1 and 2 (SDS1 and SDS2), absorber rod controls, and turbine
electrohydraulic control, are contributing to component failures. As a result, several
age-related failures challenged operators and resulted in SDS channel trips and a
turbine load reduction. Contributing is a lack of comprehensive strategies to address
life cycle issues.

2012 Several critical electrical components are experiencing age-related failures because of AFI
inadequate PM activity scope. These failures have resulted in a reactor half scram and
additional safety system unavailability hours. Contributing to this is insufficient use of
vendor and fleet operating experience during scoping reviews of electrical PM
templates. Additionally, engineering managers do not ensure equipment failure
investigations identify additional PM programme vulnerabilities.

2013 Ageing and obsolescence issues, inadequate PM, single point scram vulnerabilities, and AFI
lack of critical spare parts are not typically identified in system health or not driven to
timely resolution.

2013 PM replacement tasks to address ageing and degradation for some critical relays do not AFI
exist, and industry guidance for replacement of relays is not consistently implemented.
Engineering managers did not ensure that a comprehensive PM and component
monitoring strategy for relays was developed.

2013 There is no consistent or proactive approach to ageing or obsolescence of equipment as AFI

well as to procedure update and use.

2013 Engineering do not have a consistent and timely approach for managing ageing and AFI
obsolescence issues. This has led to limiting condition of operation (LCO) entries and
equipment unavailability. Unidentified issues could aggregate and challenge nuclear
safety in the future.

2013 Age-related failures of key components resulted in the loss of electrical power sources AFI
for important safety systems and have the potential to complicate mitigating or coping
with loss of offsite power events. Engineering managers have not established or
reinforced the need to develop ageing replacement plans for key components that
support the station power source reliability.

2014 Increasing critical equipment failures are occurring as a result of ineffective ageing AFI
mitigation strategies. This has resulted in critical equipment failures, transients and
many power reductions. Contributing to this, managers do not effectively communicate
standards and expectations for the development of comprehensive long-term

WWW.WANO.ORG 9
LIMITED DISTRIBUTION WANO RPT 2015-3

equipment ageing management plans.

2014 Age-related degradation of some power supplies and relays adversely impacts plant AFI
systems reliability, including unplanned emergency diesel generator unavailability, a
loss of 4160V blackout bus, and loss of function for a containment spray heat
exchanger.

2014 In several cases, age-related failures are occurring on circuit cards and electrical AFI
subcomponents in systems that monitor and control reactivity.

2014 Preventive strategies are not in place for some important equipment to mitigate age- AFI
related degradation and maintain long-term reliability.

2012 Circuit card maintenance and ageing management strategy incorporates best practices Strength
and industry OE. Failure rate of circuit cards has decreased by 50% over two years.

A circuit card reliability governance document was created and used fleet-wide.

The circuit card working group meets monthly to establish metrics and conduct
benchmarking. Cause codes were developed for station condition records and work
orders to allow circuit card trending capability.

Circuit cards for important systems were upgraded; for example, turbine generator
electrohydraulic control electronics and standby generator logic controls.

The most common problems identified in these AFIs were the following:

Ageing and obsolescence of electronic components within critical systems contributed to component
failures and led to LCO entries and equipment unavailability.

Age-related degradation mechanisms were not understood and documented for the families of
subcomponents such as circuit cards, relays and capacitors.

Equipment monitoring, PM and ageing replacement plans for some key electronic components in
systems that support the power supply, reactivity control and control rod drive, have not been
established to address age-related degradation.

Other insights have become apparent through analysis of the AFIs:

Several PRs identified that the station does not have a rigorous, integrated strategic planning process
to address refurbishment or replacement of ageing or obsolete equipment. Engineering personnel do
not have a consistent or proactive approach for managing ageing and obsolescence issues.

Comprehensive strategies were not developed for some important equipment to address age-related
degradation and maintain long-term reliability.

There was insufficient use of vendor and fleet operating experience for managing ageing and
obsolescence issues.

WWW.WANO.ORG 10
LIMITED DISTRIBUTION WANO RPT 2015-3

Conclusions and Key Lessons Learned

Many stations have optimised their preventive strategies and life cycle management plans to prevent
failures prior the components end-of-life. Time-based replacements, refurbishments, equipment upgrades
or periodic testing are typical preventive strategies. (See AP-913 for details). The AFIs and events reported
to WANO indicate that some stations still have a reactive broke/fix approach; reactively implementing
ageing management plans for electronic components rather using a proactive and strategic approach.

Since each nuclear power plant contains thousands of components and limited maintenance resources, one
approach is to focus preventive strategies on those most important to nuclear safety and plant reliability.
This would include a goal to eliminate critical component failures. Preventive strategies for non-critical
components are less rigorous and some less consequential failures are expected. Little to no preventive
measures are taken on run-to-maintenance components as their failure have no impact on nuclear safety
or plant reliability.

One challenge involves identifying and classifying electronic components, because they are often a
subcomponent to larger equipment and the subcomponent may not have a unique plant equipment
identification number. Therefore, in some cases, electronic components may not have an adequate
preventive strategy even though there is sufficient vendor information and operating experience that
identifies failure modes and corrective actions. Another challenge is knowing the true age of electronic
subcomponents as time spent in storage or on the shelf can introduce ageing affects prior to installation.

Preventive strategies are often based on vendor recommendations, station and industry OE, and industry
research (such as preventive maintenance templates). Vendor recommendations alone may not be
sufficient because their recommendations do not typically consider conditions that can accelerate ageing
such as environmental factors (operating temperature, humidity, radiation, etc.) and service conditions
(continuous operation, standby, modulating, etc.). Therefore, it is important to adjust vendor
recommendations based on operating conditions and operating experience (station and industry). Some
additional lessons learned from related events include the following.

1. An accurate cause determination needs to be performed for critical components to ensure

appropriate corrective actions are identified. In several reports ageing or lack of preventive
maintenance is assigned as the main cause of the event although the component was replaced
without performing detailed failure analysis.

2. A replacement strategy should be considered for electrolytic capacitors in critical applications. Long-
term OE strongly suggests that time based replacement is the most effective strategy for electrolytic
capacitors.

3. Review the applicability of testing and performance monitoring for some types of electronic
components. Because of the high number of electronic components (for example, circuit cards and
relays) installed in nuclear plants and the vulnerability of infant mortality, a few stations prefer
performing testing on a sampling basis and monitoring degrading parameters and failure rates instead
of widespread periodic replacements. If key component parameters are degrading or failure rates
increase above an acceptable threshold, then the sample population should be increased and other
preventive strategies must be re-evaluated.

4. Existing maintenance guidelines for electronic components should be used. Some of the existing
guidelines from the Electric Power Research Institute are publically available with others under
development. See reference section for details on maintenance guidelines for circuit boards,
capacitors and relays. Related documents have also been presented by other sources.

5. Implementing an equipment reliability process based on AP-913 Equipment Reliability Process

Description, available on the WANO member website, should be considered. Plant equipment is

WWW.WANO.ORG 11
LIMITED DISTRIBUTION WANO RPT 2015-3

classified by importance to safety and reliability using categories such as critical, non-critical, or run to
failure (or maintenance). Life cycle management plans are then developed for critical and some non-
critical components equipment subject to ageing. For electronic components, life cycle management
plans may include periodic replacement, periodic testing, condition monitoring or other preventive
strategies. If components are obsolete, stations should aggressively obtain remaining spare parts. If
the original component specifications or electrical schematics are available, refurbishment of the
original components may be an option. Upgraded or equivalent replacements may be required if the
old part is unavailable or cannot be refurbished.

6. Single point vulnerabilities should be identified and evaluated if actions are warranted to prevent
age-related failures. Non-safety related control systems in older stations that support plant reliability
(such as turbine control, main generator, feedwater control) contain single electronic components
that, when failed, can result in reactor scrams or unplanned power reductions. Therefore, it is
important to identify these single point vulnerabilities and evaluate if actions are warranted to prevent
age-related failures. Time based replacements may mitigate the failure. Design changes to add
redundancy can eliminate the single point vulnerability. Design changes or upgrades are expensive and
may take several years for approval and implementation. In the interim, stations typically consider
establishing short term actions such as additional testing or performance monitoring to bridge the
time gap until final resolution.

7. Failure prevention strategies for electrical components used in switchyards should be evaluated.
Failure of electrical components supporting switchyard equipment and systems can adversely impact
plant reliability. The station may not own or have control of these components or may not be aware if
adequate failure prevention strategies are in place. SOER 1999-1 Addendum 1, Recommendation 3,
states to verify that plant and switchyard high-voltage grid distribution equipment have adequate PM.
Additionally, to review and provide oversight of preventive maintenance programmes for plant
switchyard equipment owned by the plant and other organisations to ensure these programmes
support reliable offsite power to the plant. However, age-related failure of switchyard components
still occasionally occurs from component ageing and lack of a life cycle plan.

8. Implement actions to minimise component failures from infant mortality. Many stations have used
an energised rack and burn in new electronic components (circuit cards and some relays) in the
maintenance shop before installation in the plant. Burn in times vary between stations, but 50 or
100 hours are common.

9. Perform detailed engineering evaluation of replacement components that are slightly different or of
a new design. Many of the original electronic components are obsolete and replacements can be
similar but not exact. Several events occurred because the newly replaced electronic components had
an unexpected response or failure modes that were not identified during engineering evaluations for
equivalency.

WWW.WANO.ORG 12
LIMITED DISTRIBUTION WANO RPT 2015-3

References

1. AP 913, Equipment Reliability Process

2. EPRI Report 1003466, UPS Maintenance and Application Guide: Revision of TR-100491

3. EPRI Report NP-7216, Protective Relay Maintenance and Application Guide

4. EPRI Report TR-102067, Maintenance and Application Guide for Control Relays and Timers

5. EPRI Report TR-112175, Capacitor Application and Maintenance Guide

6. EPRI Report 1001257, Capacitor Performance Monitoring Project

7. EPRI Report 1007916, Printed Circuit Board Maintenance, Repair, and Testing Guide

8. EPRI Report 1011709, Evaluating the Effects of Ageing on Electronic Instrument and Control Circuit
Boards and Components in Nuclear Power Plants

9. INPO Report 14-001, International Equipment Reliability Benchmarking Report

10. WANO PO&C 2013-1, Performance Objectives and Criteria

11. IAEA Safety Guide NS-G-2.12, Ageing Management for Nuclear Power Plants

12. ANSI/ESD-S20.20-2007, Development of an Electrostatic Discharge Control Program for Protection of

Electrical and Electronic Parts, Assemblies, and Equipment

WWW.WANO.ORG 13
LIMITED DISTRIBUTION WANO RPT 2015-3

REPORT RPT 2015-3

Attachment 1

Electronic Equipment Ageing Related Events Reported to WANO

WER PAR 14-0722 Auxiliary Feedwater Pump not Ready for Operation

WER PAR 14-0267 Failure in the Power Source of the Reactor Level Loops Which Intervenes in the
Turbine Trip Logic

WER PAR 14-0119 Start and Standby Boiler Feed Pump Speed Control Failure

WER ATL 14-0224 Circuit Breaker Remains Open Following Grid Disturbance

WER PAR 13-0409 M2 Condition (Scram Signal) Blocked in a Train for One Hour

WER ATL 12-0706 Ageing and Obsolescence Issues With Electronic Components

WER PAR 12-0107 Unplanned Trip of Reactor 2 Following Loss of 2D 11kv Unit Board due to Grid
Disturbance Protection

WER TYO 14-0122 Condensate Recirculation Valve Was Opened Abnormally Caused by Valve
Control Card Failure

WER PAR 14-0486 Multiple Return to Service Issues on the Main Boiler Feed Pump Following Unit 1
Statutory Outage

WER ATL 14-0597 Unplanned Power Increase due to Recirculation Flow Control Valve Lockup

WER ATL 14-0542 Moisture Separator Reheater Temperature Control Valve Failed Closed Resulting
in A Level 4 Reactivity Event

WER ATL 14-0316 Sluggish Reactor Recirculation Pump Response Results in Unplanned Step
Changes

WER ATL 14-0262 Misalignment of Two Control Rods During Movable Control Assembly
Surveillance

WER ATL 13-0186 4A Feedwater Heater Level Controller (LC-1250A) Tripped 1A Heater Drain Pump

WER ATL 13-0092 Reactor Feed Pump "A" Trip Due to Logic Card Input Buffer Failure

WER ATL 13-0052 125VDC Charger Declared Inoperable

WER ATL 12-0369 Spurious Trip of Shutdown System 2

WER PAR 14-0776 Slow Rise of Readings of Two Neutron Flux Measuring Channels
(D1RPN010/040MA)

WER ATL 15-0262 Emergency Diesel Generator Battery Charger Failed

WWW.WANO.ORG 14
LIMITED DISTRIBUTION WANO RPT 2015-3

WER ATL 13-0312 Failures of Fire Protection System Components

WER TYO 14-0075 NIS Channel D Train Inverter Failed due to a Bad Control Printed Circuit Card

WER ATL 15-0133 Variable Frequency Drive Controller Underwent an Un-Demanded Reboot

WER ATL 14-0889 Card Failure in Feedwater Pump/Turbine Control System

WER ATL 14-0869 Automatic Reactor Scram on High Average Power Range Monitor Flux

WER ATL 14-0514 Loss of a Power Supply Resulted in a Half Scram

WER ATL 14-0013 Control Rods Failed to Move in Response to Demand Signal

WER ATL 13-0670 Automatic Reactor Scram Following Turbine-Generator Trip

WER ATL 12-0712 Automatic Reactor Trip on Low Steam Generator Water Level and Discovery of
After-the-Fact Unusual Event Condition

WER MOW 15-0038 Steam Dump to the Atmosphere and SG Safety Valve Failure

MER TYO 12-068 Reactor Trip due to Inadvertent Open Of 13.8kV Breaker

MER ATL 12-315 Process Instrument and Control Rack Protection; Channel 1 Loop Power Supply
Failure

WER PAR 14-0802 Fault Alarm Received on Fire System

WER PAR 12-0224 Shutdown Rod Bank Fault During a Hot Test

WER PAR 12-0109 Loss of Reactor 1 Regulating Group 2 Control Rods

WER PAR 12-0106 Current Intrusion In L2CEX001UP Downstream Causing L2LCE Low Insulation
Alarm

WER TYO 14-0106 Alarms due to RCS Temperature Deviation Card Failure

WER ATL 13-0690 Steam Flow Channel Failed Low

WER ATL 13-0164 Overheating of Digital Electro-Hydraulic Control System Electronic Cards Installed
in VB-48-3

WER PAR 15-0070 Emergency Diesel Startup Overtime (D2)

WER PAR 14-0748 Auxiliary Feedwater Pump not Ready for Operation

WER PAR 14-0706 Spurious Start of Turbine Driven Auxiliary Feedwater Pumps and Emergency
Diesel Generator due to Undervoltage on the Emergency Busbars During a
Voltage Recovery Test

WER PAR 14-0698 Feed Water Pump Failed to Start

WER PAR 14-0636 Refuelling Delays due to Dirty Relay Contacts

WWW.WANO.ORG 15
LIMITED DISTRIBUTION WANO RPT 2015-3

WER ATL 14-0785 Turbine Trip due to Spurious Activation of Sudden Pressure Relay on Main Output
Transformer

WER ATL 14-0763 High Pressure Core Spray Pump Breaker Tripped During Surveillance Testing

WER ATL 14-0655 Static Inverter Swap to Alternate Feed

WER ATL 14-0467 Reactor Manual Control Rod out Permit Relay Failed During Startup

WER ATL 14-0443 480V Reactor Protection System Motor Generator Set Stopped

WER MOW 14-0081 Turbine Quick Acting Valves Closed due to Wrong Manipulation During the Repair
of TG32 Fire Button

WER TYO 14-0037 Fault Alarm Activated in the Unit Protective Differential Relay

WER PAR 14-0158 Reactor Scram Following the Trip of Reactor Coolant Pump 2 Caused by a Faulty
Relay

WER ATL 14-0257 Loss of Decay Heat Removal due to Failed Contactor Coil

WER PAR 14-0076 Oskarshamn 3 Automatic Scram due to High Pressure in the Reheater

WER TYO 13-0189 Inadvertent Trip of Reactor Recirculation Pump-A

WER PAR 13-0223 Main Boiler Feed Pump Over Speed Protection

WER ATL 13-0111 Emergency Diesel Generator Lockout Relay Tripped While in Standby

WER ATL 13-0092 Reactor Feed Pump "A" Trip due to Logic Card Input Buffer Failure

WER ATL 13-0075 Manual Reactor Trip Initiated When Two Control Rods Indicate Intermediate

WER MOW 12-0087 Decrease of the Unit Power Output Because of the Loss of Power Supply to the 6
kV Switchboard Caused by a False Action of the Flash Protection.

WER TYO 12-0171 EDG Manually Stopped Caused by Exciter Voltage Abnormal

WER PAR 12-0107 Unplanned Trip of Reactor 2 Following Loss of 2D 11kV Unit Board due to Grid
Disturbance Protection

WER ATL 12-0419 Emergency Diesel Generator Failed to Develop Voltage During Testing

WER MOW 14-0021 Escalated Malfunction Risk in the Safety Classified Relays (ABB Type NF62E and
Type NF44E)

WER PAR 12-0098 Reactor Automatic Scram Caused by a Loose Relay in the Cabinet of the
Generator and Power Transmission Protection System

WER PAR 14-0055 Diesel Generator Lube Oil Heater Control Failure

WER ATL 14-1069 Reactor Water Clean Up System Manual Isolation

WWW.WANO.ORG 16
LIMITED DISTRIBUTION WANO RPT 2015-3

WER MOW 15-0004 Spurious Insertion of 12 Scram Rods of the Fast Acting Scram System (FASS)

WER ATL 14-1072 Insufficient Implementation of Preventative Maintenance Change Presents Risk
of Unit Shutdown

WER TYO 14-0176 The Loss of Functions in 1A EDG Caused by Tachometer Failure

WER PAR 14-0765 Electric Arc During the Exchange of a Transducer Caused Power Reduction and
Mobilisation of the Fire Brigade

WER TYO 14-0154 The Loss Of Functions in the Ex-core Neutron Flux Monitoring System Channel B

WER ATL 14-0763 High Pressure Core Spray Pump Breaker Tripped During Surveillance Testing

WER PAR 14-0454 Electric Power Automatic Reduction to 520 MWe During the Secured Service
Cooling Water Pump Startup

WER ATL 14-0564 Failure of Capacitor in 120 V AC Non-Vital Bus Isolation Transformer

WER ATL 14-0542 Moisture Separator Reheater Temperature Control Valve Failed Closed Resulting
in a Level 4 Reactivity Event

WER PAR 14-0031 Reactor Trip as a Result of Turbine Trip With P-7, due to Activation of the
Alternator Electrical Protection Systems

WER PAR 13-0407 De-Energised Battery-Backed Safety Bus due to an Exploded Capacitor for About
One Hour

WER ATL 13-0397 Delays in Turbine Run-Up due to Ageing and Obsolescence of Governor System

WER TYO 13-0024 Emergency Diesel Generator Load Fluctuations due to Speed Setting Drifting Low
of Mechanical Governor

WER ATL 13-0761 120 Volt Non-Class 1E Vital Distribution Panel Discovered With an Elevated
Voltage of 140 V AC

WER MOW 13-0012 An Automatic Reactor Scram Caused by Tripping of Three out of Four Running
Reactor Coolant Pumps on Lo-Lo Steam Generator Levels Caused by Turbine
Driven Feedwater Pump Controller Malfunction

WER ATL 14-0069 Emergency Declaration Caused by Toxic Smoke

WER ATL 14-0122 Manual Reactor Scram Following Loss of Uninterruptible Power Supply

WER ATL 14-0193 Automatic Scram Following Turbine-Generator Trip

WER PAR 13-0460 Smoke Coming from Motor of the Hanging Fan in Storage Building

WER TYO 13-0142 Malfunction of the Unit Overall Differential Protection Relay

WER PAR 13-0266 Priority Control Modules With Defective Capacitors in Position K4

WWW.WANO.ORG 17
LIMITED DISTRIBUTION WANO RPT 2015-3

WER ATL 13-0499 A New 230 kV Breaker Faulted and a Capacitor Failed in Summer 2 and 3
Switchyard

WER PAR 13-0119 High Pressure Core Injection Inoperable due to Power Supply Inverter Failure

WER TYO 13-0025 Plant Shutdown due to the Failure of Ex-core Nuclear Instrument System

WER ATL 12-0694 Loss of GE Mark VI P1-S (Pressure Processor) Core During Refuelling Outage

WER ATL 12-0589 Fire Alarm in Inverter Room T2-607

WER ATL 12-0487 Vital 120 V AC Inverter Blows DC Input Fuse During Startup Attempts due to
Insufficient Input Filter Capacitance

WWW.WANO.ORG 18
LIMITED DISTRIBUTION WANO RPT 2015-3

REPORT RPT 2015-3

Attachment 2

Examples of Electronic Equipment Failures

Consequential Events Classified as Noteworthy

WER ATL 13-0397, Delays in Turbine Run-up Due To Ageing and Obsolescence of Governor System, (Bruce A
4) 4 April 2013

During run up of the unit turbine, the governing system failed to complete its transfer from wide range to
narrow range control. The turbine was manually tripped for nuclear safety reasons. Troubleshooting
identified abnormalities with the speed detector (SD) modules within the turbine governing system.

Ageing and obsolescent SD modules were the cause. This event was noteworthy because it delayed unit
return to service by six days.

WER MOW 14-0021, Escalated Malfunction Risk in the Safety Classified Relays (ABB Type NF62E and Type
NF44E), (Loviisa 1) 29 January 2014

During emergency diesel generators (EDGs) periodic testing escalated risk of safety classified relays failure
was identified. Some of relays did not actuate or they actuated after a two- or three-minute delay which
increased risk for EDG common cause failure. The event was noteworthy because the potential safety
impact to emergency AC power.

The vendor supplying the relays was aware that that relay malfunctions were occurring, but quality issues
were not communicated from manufacturer to the plant.

Consequential Events Classified as Trending

The following are consequential examples of events classified as Trending. There were several events
caused by not having a strategy for preventing critical circuit card failures. In this case, vendor
recommendations were not followed.

WER ATL 14-0262, Misalignment of Two Control Rods during Movable Control Assembly Surveillance,
(Byron 2) 14 January 2014

During normal operation and while performing a control assembly surveillance, a control rod dropped into
the reactor and an additional control rod was misaligned, resulting in a reactor power reduction to
500MWe and a reactivity management event. A failed slave cycle decoder circuit card resulted in a control
rod misalignment, which required a down power to correct the condition.

There was no preventive maintenance to inspect card edges or replace the cards. The vendor
recommends replacement of these circuit cards every 19.5 years. Neither of these circuit cards had been
proactively replaced. Planned actions included replacement of all circuit cards of this type and sending
the cards to vendor for analysis.

WWW.WANO.ORG 19
LIMITED DISTRIBUTION WANO RPT 2015-3

Simplified Stationary Slave Cycle Decoder Card

Events have been caused by relay contact degradation. In the following example, relay contacts were not
checked and replaced before failure.

WER TYO 12-0171, EDG manually stopped caused by exciter voltage abnormal, (Kori 2) 19 September 2012

During an emergency diesel generator (EDG) surveillance test, the diesel generator was manually stopped
because of abnormally rising generator voltage and current caused by field shutdown relay (K1) auxiliary
contact degradation. The relay was not checked and replaced before failure because there is no periodic
monitoring programme. Planned future actions include checking and replacing the relay during every
outage.

In several cases, the capacitor leakage exceeded the acceptable design value. The following is an example.

WER TYO 14-0176, Loss of Functions in 1A EDG Caused by Tachometer Failure, (Maanshan 1) 29 August
2014

During normal operation, several alarms indicating standby emergency diesel generator (EDG) tachometer
failures were received and the EDG was declared inoperable. The cause of failure was an aluminium
electrolytic capacitor (C4) which resulted in two tachometer relays actuating. Capacitor leakage current was
over acceptable design value such that the amplifier could not get stable working voltage for the power
circuit.

WWW.WANO.ORG 20
LIMITED DISTRIBUTION WANO RPT 2015-3

The failure capacitor had been periodically replaced in 2013, but it was shipped to the plant in 2007. So the
shelf storage time was over six years.

WWW.WANO.ORG 21
LIMITED DISTRIBUTION WANO RPT 2015-3

REPORT RPT 2015-3

Attachment 3

Ageing Management Strength from Benchmarking

(Note this was extracted from Reference 9)

In plants in Asia and Europe, long-term asset management is a central part of the station maintenance
strategy and is instrumental in allowing long-term unit operation. Beznau has a detailed long-term asset
management plan. It is the cornerstone of many preventive maintenance programmes as well as how the
plant is operated. The programme is maintained for all key safety systems and components, down to the
functional subcomponents (that is pressure retaining boundary). An analysis was performed that
catalogued all applicable ageing mechanisms, component material, operating environment, and system
design and operating parameters. For each subcomponent, the ageing mechanisms were compared to the
various site programmes; preventive maintenance, in-service inspection; and any other periodic inspection
and test programmes. This was used to determine if the maintenance and inspection programmes are
adequate to prevent failure. Additional features of the catalogue include the following:

critical spare parts are defined

the date of repair/replacement of the subcomponent

operating transients are kept current

related operating experiences are included

contains references to the latest industry technical documents

ageing management basis document

The catalogue also contains active components. It is divided into three areas; electrical, mechanical and
civil/structural. Currently, there are up to 38 catalogues in each area and each is kept current. Each
catalogue contains a matrix of subcomponents versus ageing mechanisms that show if a subcomponent is
susceptible to a particular ageing mechanism. These metrics are used to evaluate whether maintenance
and surveillances are adequate, track performance, and allow financial analysis to determine whether
components are nearing the age for replacement. A group of 12 senior managers (technical and financial)
meet once every two years to review and modify these documents.

WWW.WANO.ORG 22
LIMITED DISTRIBUTION WANO RPT 2015-3

Ageing Management Programme

WWW.WANO.ORG 23
This page is left blank intentionally
This page is left blank intentionally
This page is left blank intentionally
This page is left blank intentionally
 ATLANTA
LONDON & HONG KONG
MOSCOW
PARIS
TOKYO
WORLD ASSOCIATION OF NUCLEAR OPERATORS

www.wano.org & www.wano.info