05000286/LER-2018-001, Reactor Trip Due to Main Generator Loss of Excitation

Reactor Trip Due to Main Generator Loss of Excitation

ML18110A088
Person / Time
Site:	Indian Point
Issue date:	04/16/2018
From:	Vitale A Entergy Nuclear Operations
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
NL-18-022 LER 2018-001-00
Download: ML18110A088 (7)

LER-2018-001, Reactor Trip Due to Main Generator Loss of Excitation

Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(iv)(A), System Actuation
2862018001R00 - NRC Website

text

~==* Entergx NL-18-022 April 16, 2018 U.S. Nuclear Regulatory Commission Attn: Document Control Desk Mail Stop O-P1-17 Washington, D.C. 20555-0001 Entergy Nuclear Northeast Indian Point Energy Center 450 Broadway, GSB P.O. Box 249 Buchanan, N.Y. 10511-0249 Tel (914) 254-6700 Anthony J Vitale Site Vice President SUBJECT: Licensee Event Report# 2018-001-00, "Reactor Trip Due to Main Generator Loss of Excitation" Indian Point Unit No. 3 Docket No. 50-286 DPR-64

Dear Sir or Madam:

Pursuant to 10 CFR 50. 73(a)(1 ), Entergy Nuclear Operations Inc. (ENO) hereby provides Licensee Event Report (LER) 2018-001-00. The enclosed LER identifies an event where the reactor automatically tripped, which is reportable under 10 CFR 50.73(a)(2)(iv)(A). As a result of the reactor trip, the Auxiliary Feedwater System was actuated, which is also reportable under 10 CFR 50. 73(a)(2)(iv)(A). This event was recorded in the Entergy Corrective Action Program as Condition Report CR-IP3-2018-00539.

There are no new commitments identified in this letter. Should you have any questions regarding this submittal, please contact Mr. Robert Walpole, Manager, Regulatory Assurance at (914) 254-6710.

Sincerely, AJV/cdm cc:

Mr. David Lew, Acting Regional Administrator, NRC Region I NRC Resident Inspector's Office Ms. Bridget Frymire, New York State Public Service Commission

NRC FORM 366 (02-2018)

U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY 0MB: NO. 3150-0104 EXPIRES: 03/31/2020 LICENSEE EVENT REPORT (LER)

(See Page 2 for required number of digits/characters for each block)

(See NUREG-1022, R.3 for instruction and guidance for completing this form http://www.nrc.gov/reading-rmldoc-collectionslnuregslstafflsr1022/r30

1. Facility Name Indian Point 3

4. Title Reactor Trip Due to Main Generator Loss of Excitation

5. Event Date

6. LER Number

7. Report Date Sequential Rev Month Day Year Year Month Day Year Number No.

02 16 2018 2018

- 001

- 00 04 16 2018

, the NRC may not conduct or sponsor, and a oerson is not reauired to resoond to the information collection.

2. Docket Number

13. Page 05000-286 I

1 OF 6

8. Other Facilities Involved Facility Name Docket Number 05000 Facility Name Docket Number 05000

9. Operating Mode Abstract (Limit to 1400 spaces, i.e., approximately 14 single-spaced typewritten lines)

On February 16, 2018, at 0201 hours0.00233 days <br />0.0558 hours <br />3.323413e-4 weeks <br />7.64805e-5 months <br />, with reactor power at 100 percent, Indian Point Unit 3 experienced an automatic reactor trip on a turbine trip, which was in response to a main generator trip. The main generator trip was initiated by actuation of the Generator Protection System due to a main generator loss of excitation.

All control rods fully inserted and all required safety systems functioned properly. The plant was stabilized in hot standby with decay heat being removed by the main condenser. The Auxiliary Feedwater System (AFWS) automatically started as expected on steam generator low level to provide feedwater flow to the steam generators. The plant was stabilized in hot standby with decay heat being removed by the main condenser. The direct cause of the loss of main generator excitation was the failure of an auctioneering diode (DB) in the Automatic Voltage Regulator Thyristor Firing Module A drawer power supply. The root cause was an improper refurbishment of obsolete Thyristor Firing Module power supplies. Corrective actions included modification of the Automatic Voltage Regulator to replace the obsolete power supplies with a new design, and creation of a Preventive Maintenance (PM) task to periodically replace the new power supplies in accordance with vendor recommendations and the PM Template.

This event had no effect on the public health and safety. The event was reported to the Nuclear Regulatory Commission on February 16, 2018 under 10 CFR 50.72(b)(2)(iv)(B) and 50.72(b)(3)(iv)(A) as an event that resulted in the automatic actuation of the Reactor Protection System when the reactor is critical and a valid actuation of the AFWS.

NRC FORM 366 (02-2018)

Note: The Energy Industry Identification System Codes are identified within the brackets { }.

DESCRIPTION OF EVENT

SEQUENTIAL NUMBER

- 001 REV NO.

- 00 On February 16, 2018, at 0201 hours0.00233 days <br />0.0558 hours <br />3.323413e-4 weeks <br />7.64805e-5 months <br />, with reactor power at 100 percent, the Indian Point Unit 3 (IP3) Control Room operators received a Turbine Trip First Out Annunciator {ALM} and an automatic reactor trip {JC}, initiated by a main generator {TB} Lockout Relay 86BU {RL Y, 86} trip. The 86BU relay trip was due to actuation of the main generator Loss of Field Relay 40 {RL Y, 40}, and resulted in a direct trip of the 345 kilo-Volt (kV) generator output breakers 1 and 3 {EL, BKR, 52}. All control rods {AB} fully inserted and all required safety systems functioned properly. The plant was stabilized in hot standby with decay heat being removed by the main condenser {SG}. There was no radiation release. The emergency diesel generators {EK, DG} did not start, as offsite power remained available and stable. The Auxiliary Feedwater System (AFWS) {BA} automatically started as expected on steam generator (SG)

{AB, SG} low level as a result of void fraction (shrink) effect. Indian Point Unit 2 (IP2) was unaffected and remained at 100 percent power.

The February 16, 2018 reactor trip event was reported to the Nuclear Regulatory Commission (NRC) in a 4-hour non-emergency notification under 10 CFR 50.72(b)(2)(iv)(B) for an actuation of the Reactor Protection System (RPS)

{JC} when the reactor is critical, and included an 8-hour notification for a valid actuation of the RPS and AFWS under 10 CFR 50.72(b)(3)(iv)(A) (Event Log No. 53216). The event was recorded in the Indian Point Energy Center (IPEC)

Corrective Action Program (CAP) as CR-IP3-2018-00539. An investigation into the cause of the. event and a post transient evaluation were initiated and completed. The root cause evaluation for this event was presented to the Plant Review Group and the post transient evaluation was presented to the Onsite Review Committee. Both evaluations were approved.

' The Generator Protection System protects the main generator from internal and extern;,il faults by tripping the field excitation breaker {BKR, 41} and the 345 kV generator output breakers 1 and 3. These circuit breakers are tripped by the Primary (86P) and Backup (86BU) Generator Lockout Relays {RL Y, 86}, which also initiate a turbine trip {JJ}.

The Turbine Protection System energizes solenoid valves 20/AST and 20/ASB {TG, PSV} to dump the autostop oil when a turbine trip is required. This removes the autostop oil pressure, allowing the turbine stop valves {TG, SHV}

to close by spring action. A turbine trip can be actuated by a: (1) main generator trip, (2) reactor trip, (3) safety injection {BQ} actuation, or 4) manual trip. The Primary and Backup Generator Lockout Relays (86P and 86BU) provide the main generator trip signals to energize the 20/AST and 20/ASB solenoid valve for a turbine trip.

The Main Generator Exciter System {TL, EXC} supplies the Direct Current (DC) field excitation current for the generator. It automatically maintains the generator output voltage and controls reactive load in accordance with the setting determined by the operator. The Exciter System is a rotating, brushless type system that consists of a permanent magnet generator (PMG) {PMG}, an Alternating Current (AC) generator {GEN}, and a rotating rectifier assembly {RECT} mounted on a common shaft. The PMG provides 120 Volt AC, 420 Hertz (Hz), 3-phase power to the exciter field through the field breaker and four Power Amplifiers {AMP}. Two Thyristor Firing Modules control the firing (on) times of the Power Amplifier thyristors (SCRs) {SCR}, and by varying (delaying) the point in _the AC sine wave at which the SCRs are pulsed, the magnitude of the current flow to the main generator exciter field can be changed. The Thyristor Firing Modules and Power Amplifiers are housed in vertically stacked drawers located in the Excitation Switchgear. Each of the two Thyristor Firing Module drawers has an internal +/-15 VDC power supply

{JX} which is energized by the PMG. The 120 VAC, 420 Hz, 3-phase supply from the PMG is stepped down to 90 VAC inside the Thyristor Firing Module and is rectified to a DC voltage. The +/-15 VDC power supply voltage is used to power all of the other circuit cards inside the Firing Module. Page 2 of 6 (04-2017)

U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY 0MB: NO. 3150-0104 EXPIRES: 3/31/2020

(~)

LICENSEE EVENT REPORT (LER)

CONTINUATION SHEET (See NUREG-1022, R.3 for instruction and guidance for completing this form http://www.nrc.gov/read ing-rm/doc-collections/nuregs/staff/sr1 022/r3l)

, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

3. LER NUMBER YEAR Indian Point 3 05000-286 2018 SEQUENTIAL NUMBER

- 001 REV NO.

- 00 Two controls are used to transmit and adjust the main generator output terminal voltage demand signals to the Thyristor Firing Modules and Power Amplifiers. These are Base Adjust and Voltage Adjust. The Base Adjuster {EC}

is used to generate the signal that determines a base or fixed value for excitation and serves as the means of adjusting voltage and reactive load in the manual mode. The Voltage Adjuster {EC} is used in conjunction with the Automatic Voltage Regulator (AVR) {90} to adjust and maintain generator output voltage or reactive load. When the AVR is,off, only the signal from the Base Adjuster is allowed to be applied to the two Thyristor Firing Modules. With the AVR in service (preferred mode), the AVR output is connected to the Firing Modules. The AVR output signal will add to or subtract from the base signal to maintain the desired main generator output terminal voltage as set by the Voltage Adjuster.

During normal full power operations, the delta connected phase transformers T1, T2, and T3 in each Thyristor Firing Module drawer provide 3-phase 90 VAC at the input to the Firing Module power supply. This 90 VAC is rectified to 90 voe, and Zener diodes regulate voltage to produce 15 voe between the +15 voe and common (COM) rails; and between the COM and -15 VDC rails. The Firing Module A and B power supplies are each provided reverse current protection via blocking diodes on their +15 VDC and -15 VDC rails. Auctioneering diodes 07 and 08 and relay K1 are provided to isolate the +15 VDC and -15 VDC output rails when the input voltage is not adequate.

However, the COM rails do not have blocking diodes and are not isolated by the K1 relay, and as such, the COM rails are not electrically isolated on a power supply failure. As discovered in a previous event that occurred on November 3, 2017 (IP3 LER 2017-004), the Thyristor Firing Module drawers have a vulnerability, in that they are redundant, but not independent. Also, due to their design, the Firing Module power supplies do not share load, so the power supply that is maintaining the highest output voltage will assume the load of both Firing Module drawers.

Following the February 16, 2018 reactor trip event, a Failure Modes Analysis (FMA) was performed to aid in troubleshooting. The FMA identified a total of 47 potential failure modes, and the troubleshooting plan systematically eliminated all but one of the potential failure modes. The remaining potential failure mode was a failure of a +/-15 voe power supply in the Thyristor Firing Module drawers. This failure mode was later confirmed during testing under controlled conditions when it was revealed that the power supply in the Firing Module A (top) drawer had an auctioneering diode (08) that intermittently failed open. The intermittent conducting/non-conducting failure mode of the 08 diode created a competition between the two power supplies for control of the +/-15 VDC buses, which caused sudden changes in power supply voltage to the components downstream in the Firing Module drawer and in the Power Amplifier drawers. Temporary monitoring equipment installed following the previous November 3, 2017 event captured data showing that such a transient occurred approximately six seconds prior to the main generator loss of field trip. The AVR sensed the transient and attempted to correct the degraded exciter field voltage by sending a signal to raise excitation to the Thyristor Firing Modules. Despite a continuous signal being applied. to increase excitation, the AVR was unsuccessful in recovering the exciter field voltage to achieve the minimum*

excitation required,. Consequently, the changes in power supply voltage caused by the intermittent failure of auctioneering diode 08 were ultimately sufficient to disrupt the exciter field for a period that was long enough to actuate the main generator Loss of Field Relay 40. This, in turn, tripped the Generator Protection System Backup Lockout Relay 86BU, and resulted in the turbine trip and automatic reactor trip. The failure of the auctioneering diode 08 in the Thyristor Firing Module A drawer power supply was the direct cause of the February 16, 2018 reactor trip event.

The Thyristor Firing Module power supplies were obsolete and no direct replacement was available. In reviewing the maintenance performed on the IP3 AVR, the Thyristor Firing Module power supplies were not periodically replaced due to a history of stable operation and satisfactory testing results. The two power supplies were refurbished in 2014 and installed during the IP3 2015 refueling outage. Refurbishment typically only targets components that are specifically failed or degraded, or generally prone to age-related failures. The root cause of the February 16, 2018 reactor trip event was an improper refurbishment of obsolete Thyristor FirinQ Module power Page 3 of 6 (04-2017)

U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY 0MB: NO. 3150-0104 EXPIRES: 3/31/2020 LICENSEE EVENT REPORT (LER)

CONTINUATION SHEET (See NUREG-1022, R.3 for instruction and guidance for completing this form http://www.nrc.gov/readinq-rm/doc-collections/nuregs/staff/sr1022/r3[J Estimated*, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

3. LERNUMBER YEAR Indian Point 3 05000-286 2018 SEQUENTIAL NUMBER

- 001 REV NO.

- 00 supplies. This caused the failure of power supply subcomponents that are considered to have a low probability of failure.

The main generator AVR system incorporates various internal setpoints and gain values for each of its subsystems.

The overall sum of these setpoints and gain values is referred to as the overall gain of the system. This gain determines how quickly the system responds to voltage disturbances, both actual and perceived. The AVR system is maintained by the equipment vendor, Siemens-Allis {S188}, and they provide a report of the system's health following the conclusion of Preventive Maintenance (PM) activities each refueling outage. In each of the reports Entergy has received, the vendor has identified that the system gain is set lower than is optimal, and recommended that an adjustment be made to improve the system response. The effect of the lower than optimal gain setting was evident from observed lag time on recovery of the field voltage during a transient and smaller response from the lower gain setting. As such, a contributing cause for the February 16, 2018 reactor trip event was that the main generator AVR has a suboptimal gain setpoint. This contributed to the event by creating a slower system response to the field voltage transient, lessening the probability of recovery.

A second contributing cause was that the main generator AVR was operating on the minimum excitation limiter (MEL) at the time of the reactor trip event. The AVR circuitry restricts machine operation outside of predetermined limits to prevent damage due to loss of synchronism with the offsite electrical distribution system. The MEL functions to boost the level of excitation provided to the main generator when a preset minimum value is reached. Operation on the MEL is an acceptable mode of operation, but is indicative of a reduced margin to the trip setpoint of the main generator Loss of Field Relay 40. At the time of the reactor trip event, the main generator had been operating for approximately four hours with reactive power adjusted to maximum leading Volt-Amperes Reactive (VARs)

(minimum reactive power level permitted by bus voltage) to comply with a request from the Consolidated Edison transmission operator. This allowed the MEL to be in control of main generator excitation, and the sudden loss of field voltage due to the failed Thyristor Firing Module A power supply D8 diode, coupled with the existing minimum field excitation, created an under-excited condition that resulted in the Loss of Field Relay 40 trip. This contributed to the event by reducing margin between the actual exciter field operating parameters and the tripping characteristics of the main generator Loss of Field Relay 40.

An extent of condition (EOC) review was conducted to determine where the same or similar conditions may exist.

For this event, the EOC was limited to the IP2 and IP3 main generator AVRs where a failure could result in a direct plant trip either by a loss of excitation or by other means. The assessment concluded that the EOC at IP3 has a low associated risk due to the extensive checks and tests following the February 16, 2018 reactor trip event, with any known degraded components having been repaired or replaced prior to returning the IP3 AVR to service. At IP2, although the AVR is of a different design (Generrex system}, the recent performance of the AVR was reviewed to identify any potential latent degradation. Based on the results of the review, no adverse trends were identified. A Generrex system calibration is due during the 2R23 refueling outage (commenced March 19, 2018), which will inspect, test, and calibrate the system. No additional actions are required within the scope of this EOC.

CAUSE OF EVENT

The direct cause of the loss of main generator excitation that occurred on February 16, 2018, resulting in an automatic reactor trip and turbine trip, was the failure of an auctioneering diode (D8) in the Thyristor Firing Module A drawer power supply. This directly caused the AVR's inability to maintain excitation.

The root cause of this event was an improper refurbishment of the Thyristor Firing Module power supplies. This caused the failure of power supply subcomponents that are considered to have a low probability of failure. Page 4 of 6 (04-2017)

U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY 0MB: NO. 3150-0104 EXPIRES: 3/31/2020 LICENSEE EVENT REPORT (LER)

CONTINUATION SHEET (See NUREG-1022, R.3 for instruction and guidance for completing this form http://www.nrc.gov/reading-rm/doc-collections/nuregs/staff/sr1022/r3D

, the NRG may not conduct or sponsor, and a person is not required to respond to, the information collection.

3. LERNUMBER Indian Point 3 05000-286 Significant contributing causes to this event are:

YEAR 2018 SEQUENTIAL NUMBER

- 001

1.

The main generator AVR has a suboptimal gain setpoint. This contributed to the event by creating a slower system response to the field voltage transient, lessening the probability of recovery.

REV NO.

- 00

2.

The main generator AVR was operating on the MEL. This contributed to the event by reducing margin between the actual exciter field operating parameters and the tripping characteristics of the main generator Loss of Field Relay 40.

CORRECTIVE ACTIONS

The following corrective actions have been or will be performed under the Entergy CAP to address the causes of this event.

An Engineering Change replaced the two existing obsolete Thyristor Firing Module power supplies with two new Acopian {A038} power supplies using redundant power packages.

The IP3 procedure for operation at greater than 45 percent power has been revised to maintain main generator Mega-VARs (reactive power) at unity (zero) or lag (no leading power factors).

An evaluation will be performed to determine if power supplies for other selected control systems are obsolete. For any obsolete power supplies identified, actions will determine if they have ever been refurbished, verify if the refurbishments have been performed satisfactorily and documented properly, and provide or develop the obsolescence strategy.

An evaluation will be performed to determine the feasibility of a gain adjustment to the IP3 main generator AVR to improve system response to transients.

The spare bias power supply for the IP3 main generator AVR will be sent for rebuild or replacement, and will be installed during the 3R20 (2019) refueling outage.

A PM task will be created to periodically replace the +/-15 VDC power supplies in the Thyristor Firing Module drawers in accordance with vendor recommendations and the PM Template.

EVENT ANALYSIS

The event is reportable under 10 CFR 50. 73(a)(2)(iv)(A). The licensee shall report any event or condition that resulted in manual or automatic actuation of any of the systems listed under 10 CFR 50. 73(a)(2)(iv)(B). Systems to which the requirements of 10 CFR_ 50. 73(a)(2)(iv)(A) apply for this event include the RPS, including reactor trip, and AFWS actuation. This event meets the reporting criteria because an automatic reactor trip was initiated on February 16, 2018 at 0201 hours0.00233 days <br />0.0558 hours <br />3.323413e-4 weeks <br />7.64805e-5 months <br /> and the AFWS was automatically actuated on a valid low SG water level signal due to shrink effect.

PAST SIMILAR EVENTS A review was performed of the past three years for IP2 and IP3 Licensee Event Reports (LERs) that reported a reactor trip resulting from a failure of the Main Generator Excitation System, including the exciter and voltage regulator. The review identified a similar event that was reported on December 20, 2017 in IP3 LER 2017-004 for an automatic reactor trip event which occurred on November 3, 2017. The reactor trip resulted from a turbine trip due to a trip of Generator Protection System Backup Generator Lockout Relay 86BU on loss of main generator excitation.

The direct cause of this event was a failed Thyristor Firing Module drawer, which affected proper operation of the redundant Thyristor Firing Module drawer. The root cause of this event was determined to be a latent design vulnerability of the IP3 AVR Thyristor Firing Module power supplies, in that shared common output nodes are not isolated after a failure. Corrective actions included replacement of the failed components in the AVR and a proposed Page 5 of 6 (04-2017)

U.S. NUCLEAR REGULATORY COMMISSION APPROVED BY 0MB: NO. 3150-0104 EXPIRES: 3/31/2020 LICENSEE EVENT REPORT (LER)

CONTINUATION SHEET (See NUREG-1022, R.3 for instruction and guidance for completing this form http://www.nrc.gov/reading-rm/doc-collections/nuregs/staff/sr1022/r3l)

, the NRC may not conduct or sponsor, and a person is not required to respond to, the information collection.

3. LERNUMBER YEAR Indian Point 3 05000-286 2018 SEQUENTIAL NUMBER

- 001 REV NO.

- 00 plant modification to eliminate the design vulnerability by electrically isolating the AVR Firing Module power supplies upon a failure. The power supply in the failed Thyristor Firing Module B (bottom) drawer was replaced as part of the corrective actions for the November 3, 2017 event.* The power supply that was discovered to have failed during the investigation of this (February 16, 2018) event was in the Thyristor Firing Module A (top) drawer. Conceivably, if both power supplies had been replaced following the November 3, 2017 event, this event may have been prevented.

However, at the time, the successful testing of the Firing Module A power supply provided no evidence of its impending failure.

SAFETY SIGNIFICANCE

This event had no effect on the health and safety of the public. There were no actual safety consequences for the event because it was an uncomplicated automatic reactor trip with no other transients or accidents, and the required primary safety systems performed as designed. The AFWS actuated and provided required feedwater flow to the SGs. The AFWS actuation was an expected reaction to the low SG water level caused by SG void fraction (shrink). This occurs after a reactor trip due to main steam {SB} back pressure that results from the rapid reduction of steam flow following turbine control valve {TA, FCV} closure. A reactor trip with the reduction in SG level and AFWS actuation are conditions for which the plant is analyzed. This event was bounded by the analyzed event described in IP3 Updated Final Safety Analysis Report (UFSAR) Section 14.1.9, Loss of Normal Feedwater.

The AFWS has adequate redundancy to provide the minimum required flow assuming a single failure. The UFSAR analysis demonstrates that the AFWS is capable of removing the stored and residual heat plus reactor coolant pump {P} waste heat following a loss of normal feedwater event, thereby preventing over-pressurization of the Reactor Coolant System (RCS) {AB} and preserving reactor coolant inventory.

The analysis in UFSAR Section,14.1.8, Loss of External Electrical Load, concludes that an immediate reactor trip on a turbine trip is not required for reactor protection. A reactor trip on a turbine trip is provided to anticipate probable plant transients and to avoid the resulting thermal transient. If the reactor {AC} is *not tripped by a turbine trip, the over temperature delta temperature (OTDT) or over pressure delta temperature (OPDT) trip would prevent safety limits from being exceeded. This event was bounded by the analyzed event described in UFSAR Section 14.1.8.

The response of the plant is evaluated for a complete loss of steam load or a turbine trip from full power without a direct reactor trip. The analysis shows that the plant design is such that there would be no challenge to the integrity of the RCS or main steam system' and no core safety limit would be violated.

For this event, all control rods inserted as required upon initiation of the reactor trip. The RCS pressure remained below the setpoint for pressurizer power operated relief valve (PORV) {AB, RV} and code safety valve {AB, RV}

operation, and above the setpoint for automatic safety injection actuation. Following the reactor trip, the plant was stabilized in hot standby with decay heat being removed by the main condenser. Page 6 of 6