05000286/LER-2009-006
| Indian Point 3 | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv)(B), System Actuation 10 CFR 50.73(a)(2)(iv)(A), System Actuation 10 CFR 50.73(a)(2)(v), Loss of Safety Function |
| 2862009006R01 - NRC Website | |
Note: The Energy Industry Identification System Codes are identified within the brackets {}.
DESCRIPTION OF EVENT
On August 10, 2009, at 20:32 hours, while at approximately 100% steady state reactor power, during a severe thunderstorm, Control Room operators received a Turbine Trip (TT) (JJ) First Out Annunciator for a Generator Primary Lockout Relay 86P Trip {RLY} and Reactor Trip (RT) {JC}. All control rods {AB} fully inserted and all required safety systems functioned properly. 6.9 KV Bus 2 {EA} failed to auto transfer to 6.9 KV bus 5 resulting in the trip of the 34 Reactor Coolant pump {AB} and de-energization of 480 volt safeguards Bus 2A {ED}. Emergency Diesel Generator (EDG) 31 {EK} automatically started and re-energized 480 volt safeguards bus 2A. The plant was stabilized in hot standby with decay heat being removed by the main condenser {SG}.
There was no radiation release. EDG-32 and 33 remained in standby as offsite power remained available. The Auxiliary Feedwater (AFW) System (BA) automatically started as expected due to Steam Generator low level from shrink effect. The event was recorded in the Indian Point Energy Center corrective action program (CAP) as CR-IP3-2009-03375.
A post transient evaluation was initiated and completed on August 11, 2009.
Prior to the event a severe weather warning was in effect and operations had entered the severe weather procedure (OAP-8, "Severe Weather Preparations") at 20:00 hours.
During a severe thunderstorm in the area, the Control Room received a Generator Primary Lockout Relay 86P Trip, Turbine and Reactor Trip annunciation and alarms for loss of Bus 2A. The Generator Primary Lockout Relay 86P received a trip signal which initiated a signal that caused a generator and turbine trip. The reactor automatically tripped due to signals derived from the turbine auto stop oil pressure switches. Technical Specification (TS) 3.8.1 (AC Sources) was entered for two offsite circuits inoperable due to inability to energize Bus 2A from any offsite circuit as a result of 6.9 kV breaker UT2-ST5 failing to close on Turbine Trip Fast Transfer. At 3:41 hours on August 11, 2009, 6.9kV Bus 2 was energized from 6.9 kV bus 5 via closure of 6.9 kV bus 2-5 tie Breaker and TS 3.8.1 exited. On August 11, 2009, at 03:55 hours, the 480 volt bus 2A normal feed breaker was closed and at 04:00 hours, EDG-31 was re-aligned for unit operation and placed in Auto. At 05:14 hours, the 34 RCP was restarted.
The Main Generator {TB} supplies electrical power at 22kV through an isolated phase bus to two Main Transformers (MT) {EL} which increase the voltage to 345 kV. The 345 kV output of the MTs is sent to the Buchanan Substation South Ring Bus {FK} via 345 kV feeder W96 {EL}. Unit 3 connects with the Buchanan Substation South Ring Bus through motor operated disconnect switch F1-3 on the W96 feeder. At the South Ring Bus, 345 kV Breakers 1 and 3 (BKR} serve to isolate Unit 3 from the Buchanan Substation. Breakers 1 and 3 are also referred to as the generator output breakers {EL}. The Buchanan Substation is where electrical power is distributed to the grid.
345 kV Breakers 1 and 3 will trip open on any of the following conditions: 1) 86P relay trip, 2) 86BU relay trip, 3) Primary Pilot Wire trip, 4) Backup Pilot wire trip, 5) TT, 6) Safety Injection (SI) signal, 7) low SF-6 gas pressure, 8) low breaker air pressure. The Generator Protection System (GPS) protects the Main Generator from internal and external faults by tripping the generator output breakers 1 and 3. The generator output breakers are tripped by Primary (86P) and Backup (86BU) lockout relays which will also cause a TT. The turbine protection system includes four spring loaded turbine stop valves, one for each of four main steam lines that are held open hydraulically by the turbine autostop oil system. A TT signal opens redundant solenoid dump valves and hydraulic dump valves which drain the autostop oil removing autostop oil pressure allowing the turbine stop valves to close by spring action.
Solenoids 20/AST and 20/ASB are energized to dump the autostop oil when a trip is required and can be actuated by, 1) generator trip, 2) RT, 3) SI, or 4) manual trip.
Emergency Diesel Generator (EDG) 31 {EK} automatically started and re-energized 480 volt safeguards bus 2A due to the failure of 6.9 KV Bus 2 to auto transfer to 6.9 KV bus 5 resulting in the trip of the 34 Reactor Coolant pump {AB} and de-energization of 480 volt safeguards Bus 2A {ED}. Inspection determined the auto bus transfer failure was due to the 6.9 KV bus tie breaker 52/UT2ST5 failure to auto close.
Troubleshooting determined that the breaker closing circuit latch switch contact that is required to be closed to permit breaker closing was not made up (open). Further inspection determined that the cause of the latch switch failing to close was due to a distorted automatic tripping cam device. The distorted or bent cam made contact with the floor resulting in holding the latch check switch permissive contact in the open position preventing breaker closure. When adjusted to the required gap, the trip cam which is connected to linkage enables closure of the Latch check Switch (LTCSa) when the breaker is fully charged. In this case, the trip cam was sufficiently bent such that the LTCSa contact could remain open thus preventing the breaker from closing.
Breaker 52/UT2ST5 had maintenance performed in July 2009. Maintenance on bus tie breakers are performed on-line and the breakers can not be cycled since the buses are energized. Therefore, a continuity check is performed to ensure that the correct breaker positioning is achieved. A continuity check as a post work test will not detect direct mechanical interferences/deficiencies. This is a contributing cause of the breaker event. There was no extent of condition since other breakers have been successfully cycled.
An evaluation of the grounding at IPEC was conducted in October 2011 and documented in Engineering Report IP-RPT-11-00046. The evaluation determined the station is susceptible to high ground potential rises (GPR) during system faults and lightning events. The worst case GPR for a system fault was calculated to be approximately 1550 volts. While not calculated as a part of the study, the GPR from a lightning strike would be much higher than from a system fault. This magnitude of GPR would make the pilot wires susceptible to lightning induced events since it is greater than the insulation rating of the pilot wires (600V). The study did not identify any material deficiencies with the Station Grounding {FC} from its original design that result in the high GPR. The susceptibility of the 345kV Primary Pilot Wires to GPR is also increased by the following: The pilot wire system {FK} was not provided with equipment to protect against GPR. Equipment (e.g., neutralizing reactors) can be applied to the pilot wire system to protect it from GPR that exceeds its insulation rating. Use of neutralizing reactors for the IPEC pilot wires which use DC monitoring relays ensure both relays remain at station ground potential.
Cause of Event
The direct cause of the RT was a main generator-turbine trip due to actuation of the generator protection primary lockout relay (LOR) 86P. The trip was most likely caused by misoperation of relay 85L1/345 due to extraneous voltage induced on the ground grid during a lightning strike. The pilot wire relay (85L1/345) is an ABB/Westinghouse Type PMG-13 {85}. The pilot wire system can be susceptible to ground potential changes at either the local (IPEC) or remote station (Buchanan Switchyard) caused by lightning strikes. During heavy lightning the potential induced in the ground can be different at each station causing current to propagate through the pilot wire causing pilot wire relay actuation. A deteriorated ground mat could limit a grounding wire's capability to mitigate a fault to ground. Relay signal cables that are grounded could be susceptible to these faults resulting in relay trip signals.
The root cause for the misoperation of relay 85L1/345 is the 345kV Primary Pilot Wire System is susceptible to the maximum ground potential rise (GPR) that could be experienced at the station based on the original design. The susceptibility to GPR is due to 1) the calculated worst case GPR is higher than the insulating rating of the pilot wires. The original design of the Station Grounding Plan does not minimize the GPR, 2) The pilot wire system was not provided with equipment to protect against GPR.
The direct cause for the tie breaker failing to close is failure of the latch check switch contact to make up as a result of the bent cam causing mechanical interference. Insufficient testing or inspection to detect mechanical interferences was contributing.
Corrective Actions
The following corrective actions have been or will be performed under Entergy's Corrective Action Program to address the cause and prevent recurrence:
- A walkdown and visual inspection was performed of 345 kV output feeder W96, but no evidence of damage, arcing was found on the feeder components including lightning arrestors, MTs, bushings, breakers, CCPDs, CT/PT boxes, insulation supports, feeder tower and cable.
- A check was performed of the pilot wire cables for continuity and capacitance, the insulation was meggered and the results were satisfactory.
- The Generator Differential Relay (87G) was calibrated and tested to ensure that the relay is within setpoint tolerances and that trip indicating lamp functions correctly.
- The Ground Overcurrent Relay (59N) was calibrated and tested to ensure that the relay is within setpoint tolerances and that the ICS functions to drop the target flag.
- The Primary Pilot Wire Trip Relay (85L1/345) was calibrated and tested to ensure that the relay is within tolerances and that the ICS flag functions to drop the target flag.
- The MT 31 and 32 Differential Relay Actuation (87T21 and 87T22) was calibrated and tested to ensure they are within setpoint tolerances and that the ICS functions to drop the target flags.
- Ground grid testing and evaluation was conducted in October 2011 and documented in Engineering Report IP-RPT-11-00046.
- Breaker 52/UT2ST5 was replaced.
- Preventive maintenance (PM) procedure 0-BKR-406-ELC was revised to enhance the tripping cam inspection steps.
- The breaker tripping cam was replaced.
- The 138 kV and 345 kV pilot wire systems will be replaced.
- Enhancements identified in Engineering Report IP-RPT-11-00046 will be implemented to the Station Grounding Plan.
Event Analysis
The event is reportable under 10CFR50.73(a)(2)(iv)(A). The licensee shall report any event or condition that resulted in manual or automatic actuation of any of the systems listed under 10CFR50.73(a)(2)(iv)(B). Systems to which the requirements of 10CFR50.73(a)(2)(iv)(A) apply for this event include the Reactor Protection System (RPS) including RT, AFWS and EDG actuation.
This event meets the reporting criteria because an automatic RT was initiated at 20:32 hours, on August 10, 2009, the AFWS actuated as a result of the RT, and EDG-31 actuated and energized 480 volt safeguards bus 2A as a result of 6.9 kV breaker UT2- ST5 failing to close on Turbine Trip Fast Transfer. The RT did not result in the failure of any primary system to function properly. Therefore, there was no safety system functional failure reportable under 10CFR50.73(a)(2)(v). On August 10, 2009, at 23:55 hours, a 4-hour non-emergency notification was made to the NRC for an actuation of the reactor protection system while critical and included an 8-hour notification under 10CFR50.72(b)(3)(iv)(A) for a valid actuation of the AFW System and EDG-31 (Event Log # 45255).
Past Similar Events
A review was performed of Unit 3 Licensee Event Reports (LERs) over the past six years for Unit 3 events that involved a RT from a lightning strike on the unit's 345 kV feeder to the Buchanan Substation. No Unit 3 LERs were identified. A review of Unit 2 LERs identified LER-2003-004 that reported a TT-RT on August 3, 2003 due to a lightning strike on Unit 2 tower No. 51 on 345kV feeder W93. There was one other Unit 2 trip reported in LER-1980-006 for a direct tip from the Buchanan Substation on June 3, 1980 due to a lightning strike on one of the 345kV/138kV transmission towers between the Buchanan Substation North Ring Bus and Millwood Substations.
Safety Significance
This event had no effect on the health and safety of the public.
There were no actual safety consequences for the event because there were no other transients or accidents at the time of the RT. Required primary safety systems performed as designed when the RT was initiated. The AFWS actuation was an expected reaction as a result of low SG water level due to SG void fraction (shrink), which occurs after a RT and main steam back pressure as a result of the rapid reduction of steam flow due to turbine control valve closure. As a result of 6.9 kV breaker UT2- ST5 failing to close on Turbine Trip Fast Transfer the EDG-31 started and energized its assigned Bus 2A in accordance with design.
There were no significant potential safety consequences of this event under reasonable and credible alternative conditions. A RT and the reduction in SG level is a condition for which the plant is analyzed. This event was bounded by the analyzed event described in FSAR Section 14.1.8, Loss of External Electrical Load.
The response of the plant is evaluated for a complete loss of steam load from full power without a direct RT and includes the acceptability of a loss of steam load without direct RT on turbine trip below 35 percent power. The analysis shows that the plant design is such that there would be no challenge to the integrity of the reactor coolant system or main steam system and no core safety limit would be violated. A low SG water level initiates actuation of the AFWS whose design has adequate capability to provide the minimum required flow assuming a single failure.
For this event, rod controls were in Auto and all rods inserted upon initiation of the automatic RT. The AFWS actuated and provided required FW flow to the SGs. RCS pressure remained below the set point for pressurizer PORV or code safety valve operation and above the set point for automatic safety injection actuation.
Pressurizer level remained on scale. Following the RT, the plant was stabilized in hot standby.