05000301/LER-2010-001
| Point Beach Nuclear Plant - | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv)(A), System Actuation |
| 3012010001R00 - NRC Website | |
Event Description:
On June 19, 2010, at 06:36 CDT, control room personnel initiated a manual reactor trip of Unit 2 from MODE 2 at 0% power. Prior to the initiation of the manual reactor trip, an automatic turbine trip had occurred as a result of the receipt of a generator lockout signal caused by actuation of the SEL 300G-64G2T third harmonic relay.
On June 18, 2010, at approximately18:12 CDT, an orderly power reduction commenced. The load ramp to 44% power had been completed by 04:53 CDT on June 19, 2010 and the unit was being maintained in a stable condition in MODE 1. The purpose of the power reduction was to perform a scheduled cleaning of condenser waterbox tubes. At the time of the turbine trip, two sets of condenser steam dump valves were isolated in preparation for this activity.
Following the manual reactor trip, all safety systems and equipment operated as expected. All rods fully inserted into the core. The NRC senior resident inspector assigned to Point Beach Nuclear Plant (PBNP) was notified of the event. The event was reported in accordance with the requirements of 10 CFR 50.72(b)(2)(iv)(B) and 10 CFR 50.72(b)(3)(iv)(A) on June 19, 2010, at 11:25 CDT.
This 60-day follow-up licensee event report is being submitted in accordance with the requirements of 10 CFR 50.73(a)(2)(iv)(A).
Event Analysis:
Modifications performed in preparation for an extended power uprate on Unit 2 involved installation of a new main power transformer and a 19 kV main generator output breaker during the Unit 2 fall of 2009 refueling outage. These changes impacted the physical configuration of the facility and necessitated the calculation of relay setpoints, including the generator stator ground third harmonic protective relays. The generator stator ground relays were disabled on November 29, 2009 in order to obtain data needed for calculation of the new setpoints. This data was obtained during plant startup on December 11, 2009. The revised calculation utilized an existing methodology that generated setpoints which were not correct for the installed configuration across the full range of power operation. The new setpoints were installed and enabled on February 24, 2010 while the unit was at 100% power.
There are two generator protection relays. Each is multi-functional and each has a one-out-of-one logic.
Therefore, each relay can trip the turbine-generator independent of the other. The setpoints on both relays were affected because the Unit 2 main power transformer was replaced and a new 19 kV main generator output breaker was added.
There were no equipment failures associated with this event. Therefore, the event does not represent a safety system functional failure.
Safety Significance:
There are two generator protection relays. Each relay is multi-functional and each has a one-out-of-one logic, meaning that each can generate a main generator lockout and trip the unit's main turbine independent of the other. These relays were affected by modifications being installed to replace the Unit 2 main power transformer and to install a new 19 kV main generator output breaker. As a result of the modifications, it was recognized that the generator third harmonic settings would need to be changed to support the changed impedance of the Unit 2 generator breaker modification. The setpoint change made to the generator stator third harmonic ground relay setpoint was conservative which resulted in a premature turbine trip. If the installed setpoint had been too high, a generator stator ground fault may not have been recognized and there could have been significant damage to the turbine-generator had a ground fault occurred. The turbine-generator is not nuclear safety-related.
To prevent reactor trip following a large step load reduction of 50% or less, the condenser steam dump valves open, discharging to the condenser. Also, following a large step load reduction greater than 50%, dumping to the condensers together with reactor trip will prevent main steam safety valve operation. The operation of the condenser steam dump valves is initiated by the error signal from the reactor coolant average temperature or header pressure. After initial opening, the valves are modulated by the Tavg signal to reduce the average temperature to the correct value. The valves are designed to rapidly open and fail in a closed position. At the time of the event, two sets of condenser steam dump valves were isolated. A reactor trip initiated by a turbine trip is automatically blocked by the P-9 permissive when three-out-of-four power range detectors are below approximately 49% power and one-out-of-two circulating pumps are running and condenser vacuum exists. The trip is automatically reinstated when two-out-of-four power range detectors are above approximately 49% power or two-out-of-two circulating pumps are not running or condenser vacuum does not exist.
With two sets of condenser steam dumps isolated, adequate heat rejection capacity remained to prevent lifting of the main steam safety valves, actuation of a protective trip, or lifting of the primary power operated relief valves (PORVs) as evidenced during the reactor trip transient. Reactor temperature stabilized above the no-load set-point temperature and automatic rod control continued to step the rods into the core. This resulted in safely shutting down the reactor core rather than stabilizing it at the point of adding heat.
A manual reactor trip was initiated in accordance with procedures to ensure that adequate shutdown margin was maintained. The operational impact of two sets of condenser steam dump valves being isolated had been included in the Operations pre-job brief prior to commencing the power reduction. All safety systems functioned as designed following the manual reactor trip. The control rods fully inserted into the core. In consideration of this, there were no adverse effects upon plant safety or upon the health and safety of the public. Therefore, this event was of low safety significance.
Cause:
The cause of the generator lockout was the generator protection third harmonic stator ground trip relay (300G-64G2P) setpoint being incorrectly calculated and subsequently installed on February 24, 2010, when Unit 2 was at 100% power. The setpoint was based upon data that had been taken when the unit was starting up following its fall 2009 refueling outage. The setpoints installed were not correct for the new plant configuration across the full range of power operation. Specifically, (1) the calculations did not include power and volts-amperes reactive (VAR) loading at varying power levels which resulted in an inappropriate relay setting; (2) the risk screening performed for the setpoint change was insufficient to assure that full validation of the proposed changes would occur prior to implementation in the field.
The third harmonic relay trip functions were removed from service on June 20, 2010, pending resolution of appropriate setpoint values. Disabling the generator stator ground third harmonic relay has no nuclear safety impact as the function is for protection of the main generator, which is not safety-related.
Corrective Action:
The following corrective actions have been taken:
1. The generator stator third harmonic relay trip functions were disabled.
2. A risk review was performed prior to the return of Unit 2 to service.
3. Recently completed setpoint changes for Units 1 and 2, associated with station uprate activities, were reviewed for adequacy. The review encompassed 55 setpoints in 13 design change packages. Based on the review, four setpoints require revision, and nine setpoints require further analysis which could result in setpoint revision.
Additional corrective actions to be taken have been entered in the site's corrective action program. The actions include:
4. Determining the continued need for the generator third harmonic trip function, including a determination of whether it should remain a trip or be an alarm function.
5. Revising the affected calculation containing the setpoint for the third harmonic distortion monitor relay using the correct methodology if the setpoint is to be reinstalled.
6. Identifying and revising engineering procedures to incorporate risk and consequence assessments, development of risk mitigation plans and related mitigating processes to establish the appropriate level of barrier controls necessary to prevent errors prior to implementation in the field.
7. Revising the setpoint change control process to remove ambiguity regarding review requirements.
8. Reviewing proposed setpoint changes to be implemented during the spring 2011 Unit 2 outage to ensure that they incorporate risk and consequence assessments and development of risk mitigation plans commensurate with the risk significance of the change.
Previous Occurrences: There have been no similar LERs submitted within the last three (3) years.
Failed Components Identified: None.
Additional Information: None.