05000361/LER-2006-003
| Event date: | 07-20-2006 |
|---|---|
| Report date: | 09-18-2006 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(v)(A), Loss of Safety Function - Shutdown the Reactor |
| 3612006003R00 - NRC Website | |
Discovery Date: July 20, 2006 Reactor Vendor: Combustion Engineering Mode: Mode 1 — Power Operation Power: 99 percent
Description of Event:
San Onofre Units 2 and 3 each have two emergency diesel generators (EDGs) [EK] to provide emergency AC power if preferred (offsite) AC power is unavailable. The "A" train EDGs provide standby power directly to safety related (1E) and one non-safety related (non-1E) 4 kV transformer; whereas, the "B" train EDGs supply standby power directly only to 1E-4kV loads. Consistent with NRC Regulatory Guide (RG) 1.75, "Physical Independence of Electric Systems," the "A" train EDGs are protected by a lE isolation breaker [BKR] and a non-1E transformer [XFMR]. The lE breaker isolates the non-1E loads from the EDG if there is a phase-to-phase fault in the non-1E circuitry.
The non-1E transformer isolates the non-1E loads from the EDG if there is a ground fault on the secondary side of the transformer. See the attached drawing.
In addition, each EDG is protected by a high impedance stator ground detection relay, which will trip the EDG if a ground fault occurs in a connected load. The ground fault protective trip is blocked during postulated accidents that result in a Safety Injection Actuation Signal (SIAS) but not blocked for non-SIAS (e.g. seismic) events.
In January 2005, SCE recognized that a ground fault on the non-1E 4 kV circuit on the primary side of the non-1E transformer would not trip the lE isolation breaker to isolate the non-1E circuit from the emergency diesel generator (EDG). Therefore, if there was a loss of offsite power with no SIAS and a coincidental or resulting ground in the non-1E circuitry on the primary side of the transformer, the "A" train EDGs could be tripped by the ground detection device before the lE isolation breaker could isolate the EDG from the faulted non-1E circuit.
Upon discovering this condition in 2005, SCE focused on the potential for fire to cause a ground on the non-1E circuitry on the primary side of the transformer. SCE's evaluation determined that the fire scenario would not prevent the EDG from performing its safety function. Because this condition represented a degradation of measures taken to minimize the potential for and effects of fires, SCE completed a design modification (in April 2005 for Unit 2 and May 2005 for Unit 3), to ensure that the ground protection device would not trip the EDG prior to the lE isolation breaker operating if there was a fault on the non-1E circuit.
In 2005, SCE determined this condition was not reportable because the EDG was found capable of performing its safety function.
In July 2006, during a NRC Component Design Basis Inspection (CDBI), the NRC questioned if SCE had evaluated whether a seismic event could also cause a fault in the same non-1E circuitry and, if so, if that condition would require a report to the NRC. SCE determined that the 2005 EDG design modifications would prevent the "A" train EDG from tripping on a seismically-induced ground fault on the non-1E circuit. However, the operability evaluation performed in 2005 did not document an analysis of seismic events that could have prevented the "A" train EDG from performing its function prior to installation of the design modifications.
1. PACIUTY NAME 2. DOCKET NUMBER 6. LER NUMBER PAGE (31 If a seismic event had occurred followed by a loss of offsite power and a ground fault on the primary side of the non-1E transformer, it is possible the "A" train EDG could have been tripped. If this had occurred during an EDG "B" train outage, both EDG trains would have been unavailable to perform their required safety function. At times in the past, a "B" train EDG has been taken out of service for planned work as allowed by the Technical Specifications. Based on the guidance provided in NRC NUREG-1022, on July 20, 2006 (discovery date), SCE concluded this past condition is reportable in accordance with 10CFR50.73(a)(2)(v)(A) and (B), as an event or condition that could have prevented fulfillment of a safety function required to maintain the reactor in a safe shutdown condition and to remove residual heat.
Cause of Event
In 1983, SCE modified the original design to attach a non-1E circuit to a 1E bus. At that time the 1E isolation breaker was installed consistent with RG 1.75 requirements. However, it was not realized that the ground fault protective trip on the EDG was faster than the lE isolation breaker. Due to the passage of time, it is not clear why this design did not preclude this condition.
Corrective Actions
In 2005, the EDG stator ground protection scheme was modified to immediately isolate the non-1E circuit when a line-to-ground fault is detected and to add a 5-second delay to the EDG ground fault protective trip. If the fault is cleared within 5 seconds of isolation of the non-1E circuit, the stator ground relay will reset and the EDG will not trip. If the fault has not cleared after 5 seconds, the EDG will trip. This change provides sufficient time for the existing non-1E circuit to separate from the lE bus without affecting the EDG.
A cause evaluation is in progress to determine why a seismic event evaluation was not formally documented when evaluating the potential causes of a fault in the non-1E circuits. Additional corrective actions may be identified and implemented.
Safety Significance
The safety significance of this past condition is minimal. The Train "B" EDGs were unaffected by this condition. The EDGs are required to function following SIAS and non-SIAS events.
1. Following SIAS events, the EDGs are required to start and load within 10 seconds. A SIAS blocks the protective EDG trip and disconnects non-1E loads from the safety-related buses.
Therefore, even before the 2005 design modifications, a fire or seismically induced ground fault on the non-1E circuit would not have prevented the "A" train EDGs from performing their required safety functions. For SIAS events, there is no safety significance to this condition.
2. Following a non-SIAS event, it is possible that if a seismic event had occurred followed by a loss of offsite power and a ground fault on the primary side of the non-1E transformer, the "A" train EDGs could have been tripped. SCE performed a probabilistic risk assessment and demonstrated that the safety significance of this condition is minimal (increase in core damage frequency of 1E-7/year and increase in large early release frequency of less than 1E-8/year) due to the low probability of this scenario, the robustness of the non-1E cable and windings on the primary side of the transformer, and the capability of using the crosstie between Units 2 and 3 to access the available "B" train EDG.
Additional Information
SCE previously reported instances of inadequate separation of lE and non-1E circuits in LERs 2000-002 and 1999-005.
"A" EDG Circuitry L Normally open Breaker Normally closed breaker (Mite Power High Impedance Ground Detection Device 4W-1E Ws To 1E Loads lE Isolation Breaker Control Bldg.
Seismic Cat I
NOME AREA OF
CONCERN Turbine Bldg.
Seismic Cat II Non-1E Transfomter rri To Non-1E Loads