05000325/LER-2005-006
| Brunswick Steam Electric Plant (Bsep), Unit 1 | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv), System Actuation |
| Initial Reporting | |
| ENS 41895 | 10 CFR 50.72(b)(3)(v)(D), Loss of Safety Function - Mitigate the Consequences of an Accident, 10 CFR 50.72(b)(2)(i), Tech Spec Required Shutdown |
| 3252005006R00 - NRC Website | |
Energy Industry Identification System (EIIS) codes are identified in the text as [XX].
INTRODUCTION
On August 6, 2005, Units 1 and 2 entered Mode 3 as a result of inserting a manual Reactor Protection System (RPS) [JC] actuation on each unit. Unit 1 entered Mode 3 at 0531 hours0.00615 days <br />0.148 hours <br />8.779762e-4 weeks <br />2.020455e-4 months <br /> and Unit 2 entered Mode 3 at 0445 hours0.00515 days <br />0.124 hours <br />7.357804e-4 weeks <br />1.693225e-4 months <br />. The units were shut down due to operability concerns potentially affecting the site's four Emergency Diesel Generators (EDGs) [EK]. EDG operability was questioned due to concerns that the setpoint for the installed EDG differential overcurrent protective devices (i.e., 87DP relays) was not appropriate. As a result, the four EDGs were declared inoperable at 1840 hours0.0213 days <br />0.511 hours <br />0.00304 weeks <br />7.0012e-4 months <br /> on August 5, 2005, and preparations to shut down the units, in accordance with the requirements of Technical Specification 3.8.1, "AC Sources - Operating," commenced. Plant systems for both units responded per design. All control rods fully inserted on both units. Unit 2 Control Rod 18-35 was found to have bounced out to position 02 and was inserted manually to position 00 at 0454 hours0.00525 days <br />0.126 hours <br />7.506614e-4 weeks <br />1.72747e-4 months <br />.
The manual RPS actuation was initiated at approximately 26 percent of rated thermal power (RTP) on Unit 1 and at approximately 28 percent of RTP on Unit 2. As a result, an expected Reactor Pressure Vessel (RPV) coolant level shrink caused the reactor vessel water level to decrease below the Reactor Vessel Water Level - Low Level 1 setpoint, which resulted in a Primary Containment Isolation System (PCIS) [JM] isolation signal to Group 2 (i.e., Drywell Equipment and Floor Drain, Traversing In-Core Probe, Residual Heat Removal (RHR) Discharge to Radwaste, and RHR Process Sample) primary containment isolation valves (PCIVs), Group 6 (i.e., Containment Atmosphere Control/Dilution, Containment Atmosphere Monitoring, and Post Accident Sampling System) PCIVs, and Group 8 (i.e., RHR Shutdown Cooling Suction and RHR Inboard Injection) PCIVs. The isolation signals closed all of the PCIVs that were open at the time of the actuations. These actuations resulted from and were part of the pre-planned sequence of reactor shut down. As such, they are not reportable in accordance with 10 CFR 50.73(a)(2)(iv).
At 2124 hours0.0246 days <br />0.59 hours <br />0.00351 weeks <br />8.08182e-4 months <br /> on August 5, 2005, the NRC was notified (i.e., Event Number 41895), in accordance with 10 CFR 50.72(b)(2)(i), of the initiation of a shutdown required by the Unit 1 and Unit 2 Technical Specifications. Since the four EDGs had been declared inoperable, this condition was also reported in accordance with 10 CFR 50.72(b)(3)(v)(D), as a condition which could have prevented the fulfillment of the safety function of a system needed to mitigate the consequences of an accident.
This condition is being reported as a voluntary LER. It has been determined that the setpoint for the 87DP relays, while not optimal, did not result in the EDGs being inoperable. Therefore, in retrospect, the shutdown of the units was not required by Technical Specifications and there was not a condition which could have prevented the fulfillment of the safety function of a system needed to mitigate the consequences of an accident.
EVENT DESCRIPTION
Initial Conditions Prior to the event, both Units were operating at approximately 100 percent RTP. At the time the manual RPS actuations were initiated, Unit 1 was in Mode 1 with RTP reduced to approximately 26 percent and Unit 2 was in Mode 1 with RTP reduced to approximately 28 percent. All required safety-related systems for both units, with the exception of the EDGs, were operable. The EDGs, while considered inoperable at the time, were available in the event that offsite power was lost.
Discussion On Thursday July 28, 2005, at 2319 hours0.0268 days <br />0.644 hours <br />0.00383 weeks <br />8.823795e-4 months <br />, during a Technical Specification surveillance test run, EDG No. 4 locked out shortly after startup and before the generator circuit breaker closed. Initial investigation found that the generator overcurrent differential relay (i.e., the 87DP relay) had operated and the lockout relay (i.e., the 86DP relay) was in the tripped position.
Troubleshooting activities began to find the cause of the 87DP relay actuation. Maintenance technicians reported that carbon dust, which is somewhat conductive, was present on the excitation system collector ring. In addition, verbal communications between Maintenance and Engineering personnel erroneously indicated that the collector ring to ground insulation resistance reading was 200 ohms, which is indicative of a shorted condition. Maintenance personnel refurbished the collector rings and brushes in EDG No. 4 in accordance with OPM-GEN005, "Diesel Generator Electrical Inspections," and on July 29, 2005, obtained satisfactory megger readings of approximately 400 Mohms. EDG No. 4 was successfully started and was declared operable at 2055 on July 29, 2005. These conditions led Engineering personnel to conclude that the cause of the EDG No. 4 lockout was excessive carbon dust buildup on the collector rings which led to a short and causing the 87DP relay to trip.
At 2030 hours0.0235 days <br />0.564 hours <br />0.00336 weeks <br />7.72415e-4 months <br /> on July 29, 2005, a common cause evaluation was completed in accordance with Required Action D.3.1 of Technical Specification 3.8.1. This evaluation concluded that EDG No. 3 was vulnerable to the same failure mechanism because collector ring preventive maintenance was last performed in July 2004. EDG No. 1 and EDG No. 2 were not considered susceptible because collector ring preventive maintenance was last performed in May and June of 2005, respectively. Based on this information, EDG No. 3 was declared inoperable at 2030 hours0.0235 days <br />0.564 hours <br />0.00336 weeks <br />7.72415e-4 months <br /> on July 29, 2005. EDG No. 3 was returned to operable status at 1030 hours0.0119 days <br />0.286 hours <br />0.0017 weeks <br />3.91915e-4 months <br /> on Saturday, July 30, 2005, after performance of collector ring preventive maintenance and successful post maintenance testing were completed.
On Monday, August 1, 2005, a root cause investigation team was chartered for assembly on August 2, 2005. This team was formed to determine the root cause of the EDG No. 4 lockout. Based on reviewing data sheets from the OPM-GEN005 collector ring maintenance for EDG No. 4, it was found that the actual, as-found collector ring to ground insulation resistance reading was 270 kohms versus 200 ohms as verbally reported. This inconsistency, as well as a lack of physical evidence of shorting, and discussions with EVENT DESCRIPTION (continued) external experts resulted in the root cause team eliminating excessive carbon dust buildup on the collector rings as the cause of the July 28, 2005, EDG No. 4 lockout.
The root cause team also reviewed historical EDG maintenance records and determined that, in 1982, the 87DP relays were replaced under Plant Modification 82-059 due to seismic qualification issues. The previous relays had a minimum pickup of 200mA (i.e., equivalent to 32 amps on the generator side). The new relays had revised setpoints which were lower, reduced from 32 amps to 16 amps. The engineering evaluation of the change stated that this would provide adequate protection for the generator and have no adverse effects on the generator stators. However, the modification did not evaluate the reduction in the operating margin of the reduced trip setpoints.
On August 5, 2005, an instrumented test of EDG No. 4 was performed. This test resulted in unexpectedly high measured differential current at the input of the 87DP relay, equivalent to 15.8 amps on the generator side. EDG No. 4 was considered degraded and two instrumented runs of EDG No. 2 were performed as part of the extent of condition assessment. As a result of an unrelated problem with 87DP relay on EDG No. 2, in both cases the EDG tripped when manipulating the associated cubicle door. However, sufficient data was collected to confirm amperage close to the 87DP relay setpoint.
Based on the data gathered from EDG No. 2 and EDG No. 4, it was determined that both EDGs were operating at or near the 87DP relay setpoint of 16 amps. As such, at 1840 on August 5, 2005, prior to completion of the root cause evaluation, a conservative decision was made to declare the four EDGs inoperable. Technical Specification 3.8.1, Condition G was entered and preparations began to shutdown both units. Unit 1 entered Mode 3 at 0531 hours0.00615 days <br />0.148 hours <br />8.779762e-4 weeks <br />2.020455e-4 months <br /> and Unit 2 entered Mode 3 at 0445 hours0.00515 days <br />0.124 hours <br />7.357804e-4 weeks <br />1.693225e-4 months <br />.
Both plant and Operator response to the manual RPS initiation were as expected.
EVENT CAUSE
The root cause of this event is the 1982 replacement of the EDG 87DP differential overcurrent relays with a vendor recommended equivalent model without adequate confirmation that the trip setting maintained appropriate operating margin.
As discussed above, the 87DP relays, installed in 1982, had setpoints which were reduced from 32 amps to 16 amps. The engineering evaluation of the change stated that this would provide adequate protection for the generator and have no adverse effects on the generator stators. However, the modification did not evaluate the reduction in the operating margin of the reduced trip setpoints.
A number of 87DP relay trips have been experienced since 1982. In each case, these failures were attributed to failed components in the excitation system. However, it now appears that as a result of the EVENT CAUSE (continued) 1982 modification, the margin between the normal operation of the exciter (i.e., 14 to 16 amps) and the setpoint of the 87DP relays is so small that minor perturbations are sufficient to cause actuation of the 87DP relay.
Although the revised 87DP relay setpoint affected EDGs' tolerance for electrical disturbances, EDG reliability remained very high. Since 1982, there have been over 1,000 EDG start demands with a demonstrated EDG start reliability of 99.15 percent. This demonstrates that the 87DP relays would not inadvertently trip without an additional electrical perturbation in its EDG system. Therefore, it is concluded that this condition did not render the EDGs inoperable.
SAFETY ASSESSMENT
The safety significance of this condition is considered minimal.
Based on preliminary information from the root cause investigation team, this design issue was conservatively considered to be a potential common cause failure, the EDGs were declared inoperable, and the units shutdown. This allowed for the relays to be replaced with upgraded relays that restored more appropriate operating margin. Further investigation of the issue concluded that each individual relay would not inadvertently trip without an additional electrical perturbation in its EDG system. Therefore, the EDGs were not susceptible to a common cause failure associated with the 87DP relay margin issue and the setpoint for the 87DP relays, while not optimal, did not result in the EDGs being inoperable.
The EDGs provide a safety significant function in the event of a loss of offsite power. However, the safety significance of this design issue is considered to be very minimal due to the proven reliable performance of the relays and the need for an additional random failure in order to cause an inadvertent EDG trip.
CORRECTIVE ACTIONS
The existing 87DP relays were replaced with new solid state relays with increased margin to the operating current.
PREVIOUS SIMILAR EVENTS
This event is associated with a design deficiency introduced in 1982. Therefore, corrective actions associated with more recent design-related issues could not reasonably be expected to prevent this occurrence.
COMMITMENTS
No regulatory commitments are contained in this report.