05000251/LER-2010-003

From kanterella
Jump to navigation Jump to search
LER-2010-003, Damaged Speed Sensor Caused the 4A Emergency Diesel Generator to be Inoperable
Docket Number
Event date: 5-10-2010
Report date: 7-9-2010
Reporting criterion: 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications
2512010003R00 - NRC Website

FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) PAGE (3)

DESCRIPTION OF THE EVENT

On May 10, 2010, during a normal start for local parallel operation of the 4A Emergency Diesel Generator (EDG) [EK, DG] for a test, frequency unexpectedly increased to approximately 63 Hz. Consequently, a normal shutdown of the 4A EDG was initiated. While shutting down, the 4A EDG locked out due to "Piston Cooling Oil Low Pressure.

The EDG operating procedure requires generator voltage to be adjusted slightly higher than bus [EB, BU] voltage. After performing this step, 4A EDG frequency increased to approximately 62 Hz. After unsuccessful attempts to decrease the speed of the 4A EDG by manipulating the governor [EK, DG, 65] control switch [EK, DG, HS], frequency had increased to approximately 63 Hz, and speed indicated approximately 930 rpm and appeared to be slowly rising. As a result, Operations personnel decided to shutdown the 4A EDG. While shutting down, the 4A EDG locked out. A review of the alarms indicated that the lock out was caused by "Piston Cooling Oil Low Pressure".

Condition Report (CR) 2010-12306 was initiated in response to the event.

This event is reportable in accordance with 10 CFR 50.73(a)(2)(i)(B).

CAUSE OF THE EVENT

The apparent cause of the 4A EDG's uncontrolled speed/frequency increase and subsequent lock-out during the normal shutdown initiation is a failure of the speed sensing magnetic pickup [EK, DG, SIC] due to being set too close to the engine flywheel.

ANALYSIS OF THE EVENT

Background

Each Turkey Point unit has two associated EDGs. Technical Specification (TS) Limiting Condition for Operation 3.8.1.1.b requires a unit's two EDGs and one of the opposite unit's EDGs to be operable to provide standby electrical power for required equipment in support of plant operation in Modes 1-4. The safety related function of the EDGs is to automatically start and provide power to required safety related loads during a loss of offsite power in order to achieve and maintain safe shutdown of the reactor [AC, RCT].

Analysis Initial identification of potential causes focused on the 2301A Electronic Governor (EG) and Governor Motor Operated Potentiometer used for speed control of the 4A EDG. Instrumentation was specified and FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) PAGE (3) Turkey Point Unit 4 05000251 2010 - 003 - installed to gather data on the function of those components during a loaded run. Additionally, the resistance of the 4A EDG magnetic pickup for the EG at the engine flywheel was measured. This measurement revealed that the subject magnetic pickup was OPEN (not within the expected range of 100­ 300 Ohms) and needed to be replaced. This particular magnetic pickup (MP2) provides a feedback input to the 2301A EG. A malfunction or failure of this magnetic pickup will impact EG function and EDG speed.

The 2301A EG is reverse acting and controls the hydraulic actuator [EK, DG, HCU] on the engine. The 2301A EG is connected to a 125VDC external power source, a magnetic pickup at the engine flywheel for a speed sensing source, and current and potential transformers for measuring the load carried by the generator.

When a magnetic material (in this case the engine flywheel gear teeth driven by the prime mover or crank shaft) passes through the magnetic field at the end of the magnetic pickup, a voltage is developed. The frequency of this voltage is translated by the speed control into a signal which accurately depicts the speed of the prime mover.

The magnetic speed sensor was inspected and found to have 0.007 inches from the tip of the probe completely worn off as if the pick-up had contacted the rotating flywheel gear. Combining the observed sensor damage, sensor clearance, flywheel run out and bearing clearance effects, it was determined that the magnetic probe contacted the flywheel, leading to the observed damage and erratic performance of the pickup.

A pressure switch [EK, DG, PS] provides the input to trip the 4A EDG in the event of low piston cooling oil pressure. This trip is enabled by the 90 rpm speed switch and is set at 12 psig falling. The piston cooling oil pump [EK, DG, P] is a positive displacement gear pump driven off of a common shaft with the main oil pump. Flow is directly a function of engine speed. The pump pressure is not regulated by any valves and is controlled by the resistance of the system and the viscosity of the oil. The piston cooling oil pump develops approximately 72-74 psig at 900 rpm and 174°F oil temperature.

The loss of the magnetic pickup sensor (MP2) signal was the direct cause of the event. It was functioning above minimum requirements at the beginning of the run on May 10, 2010 as the 4A EDG initially went to both idle and rated speed as demanded. However, as damage continued, the output of the speed sensor became erratic, driving the EG to respond to non-existent speed deficiencies to the point that engine speed increased beyond the swap over to the hydraulic governor and eliminated operational control of engine speed via the EG. However, the speed sensor was still functioning in some degraded state even at that time as the EG resumed immediate control upon demand for a normal shutdown. Only the EG and the shutdown solenoid can reduce engine speed after the diesel is on the hydraulic governor. There was no indication that the shutdown solenoid was energized; therefore, the EG likely resumed control. However, during the reduction to idle and cool down, engine speed continued to decay until a lockout was generated on low piston cooling oil pressure. Further degradation in speed sensor pickup is expected at lower speed and aggravated by accumulated damage. The lockout was considered valid and an indication that engine speed fell considerably below the 450 rpm target which would cause the piston cooling oil pump pressure to fall below its 12 psig trip setpoint. Following replacement of the speed sensor, all data gathered indicated normal, expected performance from each of the EDG control components.

FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) PAGE (3) The magnetic pickups are set during each major maintenance outage (CMM) and, as was seen in this instance with the 4A EDG, an incorrect setting is self-revealing after a few hours of runtime. The last CMM performed on the 4B EDG was in January 2009. The last CMMs for the 3A and 3B EDGs were back-to­ back in September/October 2008. No similar issues concerning speed control have been encountered with the other three EDGs; therefore, there is reasonable assurance that this issue is limited to the 4A EDG.

Past Operability Assessment The 4A EDG was removed from service at approximately 1230 hours0.0142 days <br />0.342 hours <br />0.00203 weeks <br />4.68015e-4 months <br /> on April 27, 2010 for maintenance.

During maintenance, the magnetic pickup was assumed to be dimensionally set within the procedural acceptance criteria, yet this was close enough to the engine flywheel gear teeth to make contact with the raised edges on the flywheel.

Had operation of the 4A EDG been demanded, there is no reasonable assurance that the magnetic pickup would have operated properly. As such, the diesel was never truly operable following maintenance. Since the failure mechanism was considered to have existed from the maintenance activity until return to service on May 14, 2010 at approximately 1043, this period exceeds the 14-day allowed outage time of TS 3.8.1.1, Action b and is a total time of 16.9 days (406.1 hours1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />).

Reportability A review of the reporting requirements of 10 CFR 50.72 and 10 CFR 50.73 and NRC guidance provided in NUREG-1022, Revision 2, Event Reporting Guidelines 10 CFR 50.72 and 10 CFR 50.73, was performed for the subject condition. As a result of this review, the condition is reportable as described below.

The 4A EDG is considered inoperable from April 27, 2010 at approximately 1230 to May 14, 2010 at approximately 1043. The condition placed Unit 4 in TS 3.8.1.1, Action b which requires restoration of "...the inoperable diesel generator to OPERABLE status within 14 days** or be in at least HOT STANDBY within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and in COLD SHUTDOWN within the following 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />." This action was not met since the 4A EDG was inoperable for approximately 16.9 days.

10 CFR 50.73(a)(2)(i)(B) requires the reporting of :

"Any operation or condition which was prohibited by the plant's Technical Specifications except when:

(1) The Technical Specification is administrative in nature; (2) The event consisted solely of a case of a late surveillance test where the oversight was corrected, the test was performed, and the equipment was found to be capable of performing its specified safety functions; or (3) The. Technical Specification was revised prior to discovery of the event such that the operation or condition was no longer prohibited at the time of discovery of the event.

FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (6) PAGE (31 As none of the three exceptions to 10 CFR 50.73(a)(2)(i)(B) apply in this case, exceeding the allowed outage time of TS 3.8.1.1, Action b is reportable.

ANALYSIS OF SAFETY SIGNIFICANCE

The approximate 16.9 days the 4A EDG is considered inoperable has minimal safety significance. Other required equipment was determined to be operable during this period.

Probabilistic risk assessment yields a delta CDF (Core Damage Frequency) of 6.1E-07 per year that falls within Region III of Figure 3 of U.S. NRC Regulatory Guide 1.174 (RG 1.174), An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 1, November 2002, defined as representing a "very small change". This figure is meant to be applied to permanent changes to the plant. The 4A EDG being out of service for 406.1 hours1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> was a one­ time, temporary condition, making this delta CDF even less of a concern. The calculated value for ICCDP (Incremental Conditional Core Damage Probability) of 2.8E-08 is well below the ICCDP threshold specified by the NRC in U.S. NRC Regulatory Guide 1.177 (RG 1.177), An Approach for Plant-Specific, Risk- quantitative impact" for a permanent TS change. Again, the 4A EDG being out of service for 406.1 hours1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> was a one-time, temporary condition, making this ICCDP even less of a concern.

The delta LERF (Large Early Release Frequency) of 1.1E-09 per year falls within Region III of Figure 4 of RG 1.174, defined as representing a "very small change". This figure is meant to be applied to permanent changes to the plant. The 4A EDG being out of service for 406.1 hours1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> was a one-time, temporary condition, making this delta LERF even less of a concern. The calculated value for ICLERP (Incremental Conditional Large Early Release Probability) of 4.9E-11 is well below the ICLERP threshold specified by Again, the 4A EDG being out of service for 406.1 hours1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> was a one-time, temporary condition, making this ICLERP even less of a concern.

To approximate the effect of external events, the delta CDF and delta LERF were doubled, resulting in a delta CDF of 1.2E-06 per year, a delta LERF of 2.2E-09 per year, an ICCDP of 5.6E-08, and an ICLERP of 9.8E-11. This assumption caused the delta CDF to move into Region II of Figure 4 of RG 1.174, defined as representing a "small change", with the delta LERF, ICCDP, and ICLERP unchanged with respect to the significance thresholds. Given the fact that this figure is meant to be applied to permanent changes to the plant, and that the 4A EDG being out of service for 406.1 hours1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> was a one-time, temporary condition, the conclusions regarding minimal impact were unchanged.

In conclusion, the 4A EDG being inoperable for an approximate 16.9 days, as a singular event, has minimal safety significance.

FACILITY NAME (1) DOCKET NUMBER (2) LER NUMBER (61 PAGE (3) Turkey Point Unit 4 05000251

CORRECTIVE ACTION

A change to the maintenance procedure will be made to ensure that the run-out of the engine flywheel gear teeth is checked and that the magnetic pickups are set with adequate clearance from the top of the highest gear tooth.

ADDITIONAL INFORMATION

component function identifier (if appropriate)].

FAILED COMPONENTS IDENTIFIED:� None (not an intrinsic failure) PREVIOUS SIMILAR EVENTS:� None