05000361/LER-2012-002

LER-2012-002, Emergency Diesel Generator Vibration Trip Not Bypassed For Non-Accident Condition

Docket Number
Event date:	03-17-2012
Report date:	09-24-2012
Reporting criterion:	10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition
3612012002R01 - NRC Website

Background

San Onofre Units 2 and 3 each have two redundant trains of Emergency Diesel Generators (EDG) [EK] to provide onsite AC power when the offsite AC power is unavailable. Each EDG powers the associated 4KV Class lE busses [BU], supplying the Engineered Safety Features (ESF) [B] for accident mitigation, and the electrical loads necessary to achieve and maintain safe shutdown. Normally, the offsite AC power from the switchyard is distributed to the safety related 4KV Class lE busses. If the offsite power is interrupted, the resulting voltage drop actuates the Loss of Voltage Signal (LOVS), automatically starting the EDGs. The LOVS also starts the EDGs in response to a degraded voltage condition to ensure sufficient power is available support an ESF actuation.

The EDGs start automatically in response to an ESF actuation, generated by the Safety Injection Actuation Signal (SIAS). Under a SIAS actuation, with a loss of power to the 4KV ESF busses, the associated 4KV ESF busses are unloaded, and the ESF components are automatically loaded in sequence after the EDG has achieved rated speed and voltage. In response to a loss of offsite power to the 4KV ESF buses without a SIAS, the LOVS automatically starts the EDGs, and the supported components are manually realigned to the bus.

The four General Motors Electromotive Division EDGs were procured from Stewart & Stevenson Services in 1977 and installed in the plant in 1981. A vibration sensor was included with the engine accessories, connected to a vibration monitor [MON] in the local panel. The vibration monitor was one of several protective devices in the non-critical engine trip circuit, and was powered by the EDG above idle speed to protect the generator bearings. As the EDG shut down the monitor would lose power, automatically deactivating the high vibration trip, and allowing the EDG supervisory trip circuit to be manually reset from either the control room or the EDG local panel.

The high vibration trip and the other non-critical trips are bypassed by a SIAS to prevent spurious loss of on-site generation when power is immediately needed for accident mitigation. The non-critical trips are active for equipment protection under other conditions that are not as time critical. The non-critical trips are not bypassed by a LOVS, unless a SIAS is also present.

Description of Event

The Metrix Model 5235 vibration sensor on Unit 2 EDG 2G003 failed during a routine surveillance test on May 12, 2011. In preparing the equipment specifications to replace the obsolete vibration sensor, engineers questioned the response of the vibration circuit to a seismic event. The engineering review was inconclusive, based on the legacy design documentation. At the time the design was questioned, March 16, 2012, both SONGS units were in Mode 5 (Cold Shutdown), and the vibration trips were promptly disabled.

The issue was conservatively reported under 10 CFR 50.73(a)(2)(ii)(B), "Any event or condition that resulted in the nuclear power plant being in an unanalyzed condition that significantly degraded plant safety," as it had the potential to affect the EDG operation described in the Technical Specifications and Updated Final Safety Analysis Report (UFSAR). The analysis completed on August 17, 2012 confirmed the high vibration trip would not have affected either EDG operation or plant safety. Therefore, this supplement provides an update to the original report and changes the reporting criteria to voluntary.

An external engineering firm with expertise in seismic testing and analysis was requested to evaluate the response of the vibration monitoring circuit to seismic events. Analytical models were developed for the vibration sensors based on the manufacturer's data and circuit analysis, correlated with direct measurements of the frequency response under shake table testing. Ground motion data for the San Onofre site were scaled to representative levels of Design Basis Earthquake (DBE) intensity, and input into a three dimensional analytical model of the EDG structure and soil-foundation interface. The vertical accelerations recorded from the output of the structural model were then used as input into the sensor model. Vibrations normally experienced as a result of diesel generator operation were also included to assure a realistic response of the sensor to both operating and seismic conditions. The integrated vibration monitoring hardware was then tested and analyzed in response to 16 seismic inputs of equivalent DBE level shaking intensity to determine the possibility of triggering a high vibration trip. The results indicated that vibration sensors did not generate a trip in any of the 16 seismic inputs with the tested vibration monitor. Based on these results, it was concluded that the intended safety function would have been performed by each EDG without experiencing a spurious trip under DBE level conditions.

Cause of the Event

Under current and past regulatory requirements, the automatic start of the EDG in response to non­ accident events does not require bypassing the non-critical trips. The original design documentation did not address the non-critical high vibration trip in sufficient detail to explain that a spurious trip would not be generated. This is a legacy issue with the original EDG qualification documentation that was completed in the late 1970s to the standards in effect at that time.

Corrective Actions

Immediate action was taken on March 17, 2012 to disable the high vibration trip circuit on the EDGs.

The Long Term Corrective Actions to confirm the response of the high vibration trip under seismic conditions, and to review the operation of the other non-critical trips were completed.

Safety Significance

The completion of the analysis confirmed the high vibration trip would not have spuriously actuated during a DBE. The EDGs, therefore, would have performed the safety function to supply on-site power to the safety related ECCS components.