05000287/LER-2009-002

LER-2009-002, Unit 3 Trip Due to Generator Phase Differential Lockout

Docket Number
Event date:	05-21-2009
Report date:	07-20-2009
Reporting criterion:	10 CFR 50.73(a)(2)(iv)(A), System Actuation
Initial Reporting
ENS 45088	10 CFR 50.72(b)(2)(iv)(B), RPS System Actuation
2872009002R00 - NRC Website

BACKGROUND

This event is reportable per 10CFR 50.73(a)(2)(iv)(A) because a valid Reactor Protective System (RPS)[JC] actuation occurred, including reactor trip.

Prior to this event Oconee Unit 3 was exiting a planned refueling outage. The unit was in Mode 1, and power was at 42%. No other safety systems or components were out of service and no evolutions were in progress that would have contributed to this event.

The relay involved in this event is an ABB HU-4 (device 87U)[87], a protective high speed unit-connected differential relay. There are three HU-4 relays on each Oconee unit which monitor X, Y, and Z phases of current from the generator. The HU-4 relay provides a trip output during the detection of a current differential on the current transformer circuits associated with the main generator, auxiliary transformer, and the two associated switchyard power circuit breakers (PCBs). When a current differential is detected, the relay sends a trip signal to the 86GA and 86GB generator lockout relays, resulting in both a generator and reactor trip.

On the HU-4 relay, taps are provided in the relay restraint and operating circuits to compensate for main current transformer mismatch. The proper tap settings are calculated, and then the relay is configured for the specific application. This relay has four restraint windings with the tap settings blocks on the front of the relay designated as 4, 1, 2, 3 (top to bottom). The HU-4 relays are a part of the original plant design.

EVENT DESCRIPTION

On May 21, 2009 at 2014 hours0.0233 days <br />0.559 hours <br />0.00333 weeks <br />7.66327e-4 months <br />, Oconee Nuclear Station experienced a trip of Unit 3. The sequence of events, including subsequent equipment failures and operator actions during recovery, ,is described below.

• In-progress, post-outage power escalation was held at 42% power to resolve unassociated equipment issue.

• Anticipatory turbine trip due to a generator lock out relay actuation, X phase.

• Generator Differential Lockout annunciated on the Electro- HydraulicControl (EHC) First Out Panel and the Sequence of Events Recorder (SER).

• The Reactor Protective System (RPS) received a Loss of Main

• Turbine Anticipatory Trip signal and tripped the Control Rod Drive (CRD) Breakers, as designed. All control rod drop times were within expected limits.

Post-Trip Response:

No safety systems actuated, other than the RPS.

On the primary side, Reactor Coolant Pumps [AB][P] continued to operate and provide.core cooling. RCS pressure, temperature, flow,

• and inventory remained within expected post-trip limits.

Secondary response was normal. Turbine Bypass Valves controlled steam generator pressure. Secondary systems remained in service and provided heat removal capability, and shutdown to Mode 4 was not necessary. The Unit was maintained in Mode 3 while post-trip reviews were completed, the cause of the event was identified, and it was determined to be safe to return the unit to service. No significant equipment failures that would have contributed to the event were noted following the, trip or during the recovery activities.

The ENS notification was made at 2309 hours0.0267 days <br />0.641 hours <br />0.00382 weeks <br />8.785745e-4 months <br /> on May 21, 2009 and assigned Event Number 45088. The reactor reached criticality on May 22, 2009 without further complication.

CAUSAL FACTORS:

The root cause of the Unit 3 reactor trip was incorrect 87U relay tap setting configuration following preventive maintenance (PM) activities during the scheduled refueling outage. During the performance of the calibration PM on the protective Unit 3 main relays,, the lead Duke Maintenance technician performing the PM made NRC '()RM _ibbA ( -2()U / ) NRC FORM 366A U.S. NUCLEAR REGULATORY COMMISSION (s -2007) a decision to change the tap settings from the as-found setting.

He noted that the as-found tap settings did not match the labeling on the relay card, but he reasoned that the relay card provided tap setting values and was not an accurate physical representation of the relay. He recognized that the . as-left settings were not the same as the as-found settings, but he rationalized that the as-left tap settings from the previous PM were incorrect. The technician made this decision without stopping and verifying with Maintenance technical support, supervision, or Engineering. Changing the tap settings to different values caused the relay to actuate, resulting in a generator lockout which in turn caused the reactor trip.

The lead technician had performed this task multiple times in the past without error; even having performed the prior Unit 3 87U relay PM in 2006. The technicians did stop and discuss the .

difference, but they did not contact technical support or engineering. The technicians did not use appropriate self-checking to ensure that their intended actions were correct.

Other factors contributing to this event were procedural inadequacies, technical inadequacies, and configuration control weaknesses. No technical procedure existed for the calibration activity for the HU-4 type relay (87U). Although the 'need for a procedure had been identified, the request received.a low priority based on the fact that the task was non-safety related and had been Performed error free for numerous years. Additionally; the HU-4 relay card, used as a record for the relay settings, Was unclear and misleading. The HU-4 relay has four restraint windings with the tap setting blocks arranged 4, 1, 2, and 3 top to bottom.

However, the relay card was written as winding 1, 2, 3, and 4. The intent of the card was for the doer to position the settings "top to bottom"; however, in this occurrence, the information on the card was interpreted as being for the corresponding winding numbers. Meaning, the winding 1 setting on the card was for winding 1 on the relay as opposed to the winding 1 setting on the card (top winding) being for winding 4 on the relay (top winding).

This event also highlighted an organizational weakness within Maintenance with regard to configuration control of equipment.

Equipment removal from and return to service is controlled in the configuration control procedure. Once the equipment has been isolated, inadequate procedural guidance exists to ensure that parameter or setting changes implemented while equipment is out of service are appropriately documented prior to its return to service.

CORRECTIVE ACTIONS

Immediate:

1) Entered Emergency Operating Procedure (EOP) (EP/3/A/1800/001).

Immediate manual actions were taken as prescribed by the EOP to place (and/or maintain) the plant in a safe and stable operating condition as quickly as possible.

2) Formed a Unit Threat Team.

3) Downloaded and reviewed Voltage Regulator data logger and concluded no fault current was being generated out of the generator at the time of the trip.

4)Reviewed auxiliary transformer 3T parameters with no anomalies noted.

5) Checked as-found tap settings bn the unit differential relay (87U). Found two out of four set incorrectly.

Subsequent:

1) Used IP/O/A/0101/001 Maintenance Configuration Control Procedure to verify the relay taps were placed back in the correct position on all three phases of the Unit 3 87U differential relays.

2) Performed testing of relay on correct tap settings to ensure that it would not trip up to full load power.

3) Verified HU-4 tap settings for the X, Y, and Z phases on Units 1, 2, and 3 set correctly.

4) Verified HU and HU-1 relays used for Unit 3 transformer set correctly.

NRC (.)RM JED(DA (9-2UU/) 7 5) Performed Maintenance Management counseling for individuals involved in this event. Personnel corrective actions taken commensurate with each individual's culpability and the significance of the inappropriate action.

Planned:

1) Develop an IP procedure for the HU-4 relay calibration PM.

Procedure should include as-found and as-left steps for tap settings.

2) Identify all protective relays that need to have tap settings added to the equipment database (EDB) in order to eliminate relay cards.

Once the relays have been identified, initiate the appropriate documentation and corrective actions for the'relay additions.

3) Identify all protective relay calibration PMs that do not have dedicated procedures.. Prioritize and create additional corrective actions to develop the procedures.

See Attachment 2 for NRC Commitment items. There are no other NRC Commitment items contained in this LER.

SAFETY ANALYSIS

This event did not include a Safety System Functional Failure. The event was uncomplicated and challenged no accident mitigation systems.

Duke Energy used a risk-informed approach to determine the risk significance associated with this event, considering the following:

• A reactor trip initiating event.

• Actual plant configuration and maintenance activities at the time of the trip.

The Conditional Core Damage Probability (CCDP) associated with this event was evaluated to be less than 1E-06. The Conditional Large Early Release Probability (CLERP) associated with this event was evaluated to be No fission product-barriers were compromised by this event.

Therefore, there was no actual impact on the health and safety of the public due to this event.

ADDITIONAL INFORMATION

A search of Oconee's corrective action database found no similar occurrences of this type of event with the same cause.

There were no releases of radioactive materials, radiation exposures or personnel injuries associated with this event.

This event is not considered reportable under the Equipment Performance and Information Exchange (EPIX) program.

NRU FORM .366A (9-2UU/) Attachment 2 Oconee Nuclear Station List of Commitments Commitment Commitment Date or Outage Prior to 1E0C25,� the HU-4 relay calibration PM.� Develop an IP procedure for . �Fall 2009 Procedure should include as-found and as-left steps for tap settings.

Identify all protective September 2009 relay calibration PMs that do not have dedicated procedures.

For protective relay PMs October 2009 which do not have procedures,�place Work Orders on hold until, procedures are developed.