05000285/LER-2004-002

LER-2004-002, Inoperable Diesel Generator for 28 Days Due to Blown Fuse During Shutdown

Docket Number
Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications
2852004002R00 - NRC Website

BACKGROUND

Fort Calhoun Station (FCS) is a two loop Combustion Engineering design Pressurized Water Reactor (PWR).

The station has two (2) Emergency Diesel Generators (DGs). The emergency diesel generators are designed to furnish a reliable source of 4160V AC power for safe plant shutdown and operation of engineered safeguards when the normal sources of off-site power are lost. The diesel generators are normally aligned in a standby mode ready to automatically start, come up to rated speed and voltage, and energize the engineered safeguard buses when required.

The DGs furnish a reliable source of 4160V AC power for safe plant shutdown and operation of engineered safeguards when the normal sources of off-site power are lost. The DGs are safety related and are required to mitigate the consequences of events that have the potential to cause a release of radioactivity. The emergency diesel generators function as an emergency power source during all phases of reactor operation. A reliable source of in-plant AC must be provided at all times to allow safe reactor shutdown and the removal of decay heat for the extended period of time until off-site power sources can be reestablished.

The diesel engines are classified as two-cycle, 20 cylinder, 900 RPM General Motors EMD (Electromotive Division) diesel engines. The generator is direct-driven by the diesel engine. The generator is connected to its respective 4160V bus through its output breaker. The DG may be operated in parallel with either of the power supplies to its 4160V bus.

Fuses 1FU and 2FU are the two fuses that protect the generator excitation bridge rectifiers. The excitation transformer is a 4160 volt to 240 volt, 25 KVA single phase transformer, often referred to as a power potential transformer. This transformer takes output from the generator stator and provides a source of 240 volt AC power to the excitation system. The AC output from this transformer feeds a full wave bridge rectifier. Should a fault occur that results in excess current through the bridge rectifier, fuses 1FU and 2FU function to stop current flow, thus protecting the bridge rectifier.

FCS Technical Specification 3.7 requires monthly operating tests for each of the DGs. OP-ST-DG-0001, "Diesel Generator 1 Check," and OP-ST-DG-0002, "Diesel Generator 2 Check," are the plant procedures that perform the monthly surveillance checks on the DGs.

EVENT DESCRIPTION

On October 19, 2004, while reviewing detailed plant computer data related to the operation of Emergency Diesel Generator Number 2 (DG-2), it was discovered that DG-2 had become inoperable for approximately 28 days beginning on July 21, 2004, and extending through August 18, 2004. The inoperability was the result of an open fuse condition affecting DG-2 voltage output. Data obtained from the plant's computer system indicates that the condition occurred as the operators were performing engine unloading and shutdown during completion of the monthly surveillance test on July 21, 2004.

The open fuse was initially discovered during the performance of the same monthly surveillance test on August 18, 2004. Initially, the open fuse was believed to have failed during the field flash and startup of the diesel generator. Troubleshooting activities performed at that time found no component failures or operating conditions that could explain the reason for the open fuse. The fuse "set" was subsequently replaced and the surveillance test was successfully re-performed.

System engineering personnel investigated the cause of the fuse failure. Both fuses were sent out for failure analysis in an attempt to confirm the reason for the fuse failure and to obtain information related to fuse condition. The results of this analysis found surface cracking on the intact fuse element of the set that was unusual. No other anomalies were noted.

System engineering personnel continued working on the assumption that the fuse failure had occurred during the start-up of DG-2 on August 18, 2004. This assumption appeared valid based upon generator voltage data that was considered by engineering personnel at that time. DG-2 voltage had increased to about 2200 volts and then stopped increasing. This behavior is what would happen if the open fuse had failed during the DG startup.

The impact of DG-2 inoperability upon NRC and WANG performance indicators for emergency AC power was then considered. Based on the generator voltage data from the August 18, 2004 test, it was concluded that no unavailability time prior to August 18, 2004, would need to be added to the August 2004 total unavailability hours. As a final check on this assumption, the system engineer was directed to obtain and review additional computer data related to the July 2004 surveillance tests. During review of the additional data, conducted on October 19, 2004, it was discovered that the fuse failure had actually occurred during the engine shutdown sequence near the end of the July 21, 2004, test. This confirmed that DG-2 was actually inoperable from the period of July 21, 2004, through August 18, 2004. Condition report 200403634 was written to document this discovery. On October 19, 2004, a review of the reportability of this event was completed. This event is being reported pursuant to 10 CFR 50.73(a)(2)(i)(B).

CONCLUSION

The investigation of the series of events leading up to the discovery of DG-2 being inoperable from July 21 - August 18, 2004 was focused on resolving the following two problem statements:

• Part 1 - Determine the cause for the blown or open fuse condition that resulted in DG-2 output voltage being below its required value for operability.

• Part 2 - Determine the cause for the delay in not identifying or recognizing DG-2 inoperability until October 19, 2004.

Part 1 On August 18, 2004, the DG-2 output voltage was indicating approximately 2200VAC instead of the expected 4200VAC. DG-2 was shutdown and subsequent troubleshooting found fuse 2FU (100A, Shawmut Amp-Trap A25X100) to have failed open. Fuse 1FU which works with fuse 2FU to protect the bridge rectifier was tested and found to have electrical continuity. No other signs of degradation in the related component circuitry were found. A review of the plant computer and surveillance data for the previous months DG-2 run on July 21, 2004, indicated that 2FU had failed at about the point in time when the DG-2 circuit breaker was opened. The failed 100 amp Shawmut fuse, and the other 100 amp Shawmut fuse in the same circuit, were sent to a laboratory for failure analysis.

Based upon the analysis of available physical evidence and troubleshooting activities, the root cause for the open fuse condition was determined to be the result of premature aging. It appears likely that the failed fuse had experienced accelerated degradation due to past cyclic loading. Due to the "paired" fuse configuration that exists in this portion of the voltage regulation system, over current conditions that result in a single blown fuse can potentially place the paired fuse in a stressed condition. This condition can lead to subsequent spurious operation due to heating effects (surface cracking) present on the fuse element surface.

Based on manufacturer recommendations, conditions such as those described previously have resulted in a general recommendation to replace "sets" of fuses within circuits that have experienced this form of overcurrent condition. The lack of a specific FCS policy or guidance document concerning the need to replace fuses in "sets," once one fuse within a set has blown, is considered a contributing cause to conditions that led to fuse failure.

Part 2 The earliest opportunity for the discovery of the failed fuse condition was when the operators responded to plant computer alarms for DG-2 Low Output Frequency and Low Output Voltage. This occurred just before opening the DG-2 output breaker on July 21, 2004, during the DG shutdown. This is a normal alarm when the DG is shutdown. Due to the length of time that transpired before the problem was recognized, information regarding the specific activities being performed in the control room at that time were not fully available for this investigation. Based on the available evidence from interviews it is likely that the alarm was acknowledged and responded to with the belief that it was the expected system response to the activities associated with shutdown of DG-2 in accordance with OP-ST-DG-0002.

The guidance provided to the operators with regard to acknowledging plant computer alarms places the burden on the individual operator to recognize whether the alarm is explainable, and if not, to investigate the cause of the alarm. No specific written response guidance nor formal list of expected computer alarms related is provided to the operators. This differs from the expectations related to control panel alarms where specific written guidance exists in the form of alarm response procedures. For this reason it has been concluded that a lack of formality or rigor in validating computer alarms which occur during the performance of routine evolutions (such as surveillance testing) is the root cause for the delay in recognizing the initial inoperability condition of DG-2.

Several contributing causes were identified related to the conditions which promoted an ineffective response to the computer alarms:

• The absence of a control panel alarm which would indicate that output voltage had dropped below required values for the condition of the diesel generator system likely provided a false sense of security that plant condition remained normal.

• The plant computer alarm display currently provides indications on a wide variety of computer alarms, as well as information concerning changes in state of a wide variety of monitored equipment such as valve and breaker positions. It is surmised that the number of alarms and changes of state flags that are presented to the operator during the course of a shift could present a challenge for maintaining appropriate attention levels due to information overload.

Finally, the operability of DG-2 was based upon the successful completion of OP-ST-DG-0002. In this case, fuse failure had occurred at a point in time after the necessary data for determining operability had been obtained.

This feature of the event helped to create the mindset that the fuse failure identified through the surveillance testing conducted on August 18, 2004 had occurred at that point in time rather than on Jnly 21, 2004. The engineering assessment activities initiated on August 18, 2004, did not consider all the available historical information from the test performed in July. This omission, or lack of consideration is considered a contributing cause for the delay in eventually recognizing the correct unavailability time period for DG-2 until October 19, 2004.

SAFETY SIGNIFICANCE

The primary offsite power source which would provide power to safety related loads in the event of an accident, the 161KV transmission system, was available and in service during the time period of unexpected EDG inoperability. The 161KV system is not only monitored continuously, its expected availability in the event of a reactor trip coincident with a design basis event is continuously predicted using transmission line system modeling software maintained by the Midwest Independent System Operator (MISO).

DG-2 is credited as the emergency power supply for safe shutdown equipment and systems. However, historical records from the MISO calculations indicate that, for the 28 day period of DG-2 inoperability, the predicted post- accident 161KV system voltage would have been at a level which would not have resulted in automatic starting and loading of the EDGs in the event of a Updated Safety Analysis Report (USAR) Section 14 accident. From this data, it is concluded that the actual impact of the DG-2 inoperability on nuclear safety is that the accident mitigations functions assumed in the USAR Section 14 analyses would have been maintained as expected. In the event of a design basis accident during the period in question it is unlikely that the health and safety of the public would not have been adversely affected.

PRA Considerations - Risk Significance Diesel generators are risk significant components as defined by the maintenance nile. The dominant core damage sequences with one or more diesel generators unavailable involve loss of offsite power as the initiating event, followed by a prolonged station blackout, depletion of the station batteries, and subsequent loss of steam generator level control. The dominant large early release sequences involve the same core damage sequences with the addition of thermally induced steam generator tube rupture. As previously described, offsite power was actually available 100 percent of the time during the 28 day period, and DG-1 was available except for 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> during the monthly surveillance testing during that time.

Therefore, this event had a minimal impact upon the health and safety of the public.

CORRECTIVE ACTIONS:

Immediate corrective actions

• The failed fuse set was replaced and DG-2 was tested satisfactorily.

• Appropriate steps have been added to the procedures that operate the diesel generator to verify correct voltage is present prior to depressing the "stop" pushbuttons when shutting down the diesel generators.

Enhancements

• FCS has revised appropriate station procedures concerning fuse replacement to require that fuses be replaced in "sets.

• System Engineering has reviewed other fuses or fuse sets associated with the operation of the diesel generator system to determine if other fuses could be susceptible to similar premature aging effects as noted in the RCA. System Engineering has written replacement work requests to be scheduled to coincide with scheduled diesel generator testing if applicable.

• Annunciator Response Procedure ARP-1, "Annunciator Response Procedure," has been revised to require reactor operators to acknowledge all computer annunciators during normal operation.

• ARP-1 has been revised to have computer alarm response match annunciator tile alarm response.

Any additional actions are documented in the corrective action system.

SAFETY SYSTEM FUNCTIONAL FAILURE:

This event did not result in a safety system functional failure in accordance with NEI-99-02.

PREVIOUS SIMILAR EVENTS:

There have not been any similar events where a diesel generator fuse failed on the shutdown of the engine which caused a failure of the diesel to start on the subsequent start of the engine.