ML14176A339

Loss of Offsite Power Due to Unneeded Actuation of Startup Transformer Protective Differential Relay

ML14176A339
Person / Time
Site:	Robinson
Issue date:	03/20/1987
From:	Ashe F NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD)
To:
Shared Package
ML14176A337	List: ML14176A336 ML14176A338 ML14176A339
References
TASK-AE, TASK-E703 AEOD-E703, NUDOCS 8704060563
Download: ML14176A339 (9)

Text

AEOD ENGINEERING EVALUATION REPORT*

UNIT:

H. B. Robinson Unit 2 REPORT NO.: AEOD/E703 DOCKET NO.:

50-261 DATE: March 20, 1987 LICENSEE:

Carolina Power & Light Company EVALUATOR/CONTACT: F. Ashe NSSS/AE:

Westinghouse/Ebasco

SUBJECT:

LOSS OF OFFSITE POWER DUE TO UNNEEDED ACTUATION OF STARTUP TRANSFORMER PROTECTIVE DIFFERENTIAL RELAY

REFERENCE:

Carolina Power & Light Company, LER 86-005 Rev. 2, Docket No. 50-261, November 20, 1986.

SUMMARY

A study was performed to review and assess information concerning loss of offsite power for auxiliary power system designs which transfer emergency buses from a unit auxiliary transformer to a startup or reserve transformer following a turbine generator trip. The review was initiated due to the loss of offsite power event which occurred in such an auxiliary power system design at H. B. Robinson Unit 2 on January 28, 1986. The related safety concern is that in these auxiliary power system designs the preferred power source (offsite power) to-the emergency buses may be lost at a time when needed to operate safety-related electrical equipment. As illustrated by the Robinson event, loss of emergency bus power may be due to direct current (DC) saturation of a current transformer (CT) associated with a startup or reserve transformer pro tective differential relay. Although the review did not identify any other similar reported event, susceptibility of such CTs to DC saturation could poten tially exist at other plants. This conclusion is supported in part by the fact that CT saturation to the extent necessary to actuate a startup transformer protective differential relay had not previously occurred in the 15-year operating history of Robinson Unit 2. In addition, the Robinson event demon strates that grid system conditions at the time during the transfer of auxiliary loads, along with a higher than usual auxiliary load in-rush current, are influencing factors.

Since IE has issued an information notice (IEIN 86-87) addressing the Robinson event and DC saturation of CTs associated with power transformer protective differential relays, the report suggests that NRR consider this event as appro priate in ongoing licensing reviews. Further, it is suggested that consideration be given to incorporating the lessons learned from this event into the next revision of Standard Review Plan Section 8.2. The report also suggests that the focus of these activities be directed at the potential occurrence of DC saturation of CTs associated with startup or reserve power transformer protective differential relays.

DISCUSSION Description of Event and Conditions On January 28, 1986, H. B. Robinson Unit 2 was operating at approximately 80 percent power. Emergency Diesel Generator (EDG) P had just been taken out-of-service to install a solid state overcurrent trip device on the EDG B

• This document supports ongoing AEOD and NRC activities and does not represent the position or requirements of the responsible NRC program office.

0 A0DOC 050637002 1PDR.

ADOCK 05000261 P

PDR

-2 output breaker. This upgrade was being performed on all safety-related Westinghouse DB tie breakers and was completed on EDG A the week before. At 0917 hours0.0106 days <br />0.255 hours <br />0.00152 weeks <br />3.489185e-4 months <br />, EDG B output-beeaker had just been racked out when emergency bus E2 lost power (see Figure 1).

The loss of power to bus E2 resulted in a loss of power to Instrument Bus 4 (I-4). The loss of power to IB-4"caused Nuclear Instrumentation System Powef Range Channel N-44 to initiate a turbine runback. However, the automatic rod control >system which receives an input signal from Channel N-44 and the steam dump control system could not function properly due to the loss of power. As a result, a reactor trip occurred on high pressurizer pressure approximately 21 seconds after power to bus E2 was lost.

One minute after the reactor trip, the main generator oil 'circuit breakers opened and plant auxiliary loads, along with emergency buses El and E2, shifted to the startup transformer as part of the normal turbine generator lockout feature. Approximately 1 second later, a West bus lockout occurred in the 115Kv switchyard which de-energized the startup transformer (see Figure 1).

This resulted in a loss of offsite power to plant auxiliary loads and emergency buses El and E2. EDG A started automatically and loaded emergency bus El.

Approximately 67-seconds after the West bus lockout occurred, Safety Injection (SI) and Main Steam Isolation Valve (MSIV) signals were generated. These signals were generated due to the presence of a high steamline flow signal coincident with a low Tave signal.

The low Tave signal was caused by the plant cooldown as a result of the reactor trip and the high steamline flow signal was present due to loss of power to IR-4. When the loss of offsite power occurred, all three reactor coolant pumps tripped and coasted down and the plant was cooled by natural circulation. The plant was stabilized at hot shutdown conditions with Reactor Coolant System (RCS) temperature being controlled with Steam Generator Power Operated Relief Valves (SGPORV). An unusual event was declared at 0935.

During the initial attempt to restore power to emergency bus E2 from EDG B, breaker cycling on bus E2 was observed. An operator was directed to remove all control power fuses from the load breakers for bus E2 to prevent breaker damage. The operator pulled all the attendant control power fuses including those provided for SI pump motor B. Subsequently, at 1027 hours0.0119 days <br />0.285 hours <br />0.0017 weeks <br />3.907735e-4 months <br />, power was restored to emergency bus E2 by manually starting and loading EDG B. Offsite power was restored to the plant non-vital electrical distribution system at 1115 hours0.0129 days <br />0.31 hours <br />0.00184 weeks <br />4.242575e-4 months <br /> after investigation revealed no faulted conditions for the startup transformer and its associated circuits.

At 1228 hours0.0142 days <br />0.341 hours <br />0.00203 weeks <br />4.67254e-4 months <br />, a second SI signal was generated. This signal was caused by steamline high differential pressure which resulted when frozen sensing lines caused the C SGPORV to stick open. This valve was closed by isolating the air supply to the valve air-operator, thus, correcting the situation. The freezing condition resulted when power was lost to freeze protection circuits.

Throughout the event, RCS pressure remained above the shutoff head of the SI pumps, therefore, no SI flow entered the RCS. At no time did RCS temperature and pressure approach saturation. Offsite power was restored to the entire plant electrical distribution system at 1601 hours0.0185 days <br />0.445 hours <br />0.00265 weeks <br />6.091805e-4 months <br /> and the unusual event was terminated at 1634 hours0.0189 days <br />0.454 hours <br />0.0027 weeks <br />6.21737e-4 months <br />.

-3 6w T

11I5 kV 6Wr'rCH%(A20 I

I M0OTOI ATEP V~y~uhlT

).(k ST.S~

1hJ 4 K..9S B T ARGIWCs 2

r"r 1TAtRGk U45vs Ztk T

RA4

2.

2 (E) I

)

(E a t3DE IC TqUjp9NC i

Q'mERG HTr I

SIZEAKEZ TH-AT OP~EJ ON% WE6S1 SUev L.O(:YOLT

-4 During the loss of offsite power event, other conditions which occurred were as follows:

1. The control room ventilation system failed to automatically align to the emergency recirculation mQde. This was due to the loss of. power to emergency bus E2.

2. During the event (from 0918 to 1105 hours0.0128 days <br />0.307 hours <br />0.00183 weeks <br />4.204525e-4 months <br />), the fire water supply to the containment vessel was isolated when the phase A isolation signal, accompanying the initial SI signal, closed fire water containment vessel isolation valves FP-248 and FP-256. Technical Specification 3.14.4.2 requires that if a hose station in the containment vessel is out-of-service, back-up protection must be provided within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />.

Although the phase A isolation signal was reset at 0936 hours0.0108 days <br />0.26 hours <br />0.00155 weeks <br />3.56148e-4 months <br />, reopening of these valves (a remote operation) was intentionally postponed to allow the operators'to concentrate on restoring offsite power.

3. Since breaker control power fuses had been pulled for SI pump motor B, only SI pump A was available for automatic or manual start. However, if SI pump B had been needed, its motor could have been started by locally closing the breaker or installing attendant control power fuses.

During this event, EDG A started and supplied power to one of the two redundant emergency buses. The dedicated shutdown diesel generator was also available. In addition, appropriate provisions were available in the Emergency Operating Procedures to control the plant for an extended period of time without any alternating current power being provided from the offsite source, the EDGs, or the dedicated shutdown diesel generator.

Investigations of Significant Occurrences Extensive investigations performed by the licensee following the event focused on the causes for two significant occurrences which occurred during the event.

These were the initial loss of emergency bus E2 and the lockout of the startup transformer (loss of offsite power). A general conclusion which resulted from these investigations was that these two occurrences were due to separate and independent causes.

Potential Causes for Loss of Emergency Bus E2 One potential cause of the loss of emergency bus E2 was attributed to a blown fuse on the secondary side of a potential transformer which supplies the E2 bus undervoltage relay. This would have caused a false undervoltage trip condition thereby initiating the bus loss of power sequence. This sequence results in isolating the bus by opening load breakers as well as the normal supply breaker. Such a power loss to bus E2 could have initiated the event.

However, this cause could not be clearly confirmed since an extensive investi gation of the attendant circuitry and equipment items did not result in identifying any unusual condition which would have caused the fuse to blow.

This being the case, it was concluded that the blown fuse also could have been a random consequential failure.

-5 The second potential cause of the loss of bus E2 on January 28, 1986 was discovered on March 6, 1986 while the plant was shut down for refueling. On this date, two station service transformers were being taken out-of-service for maintenance on a common supply breaker. While in the process of energizing E2 via El (cross tie El and E2) the F2 normal supply breaker tripped open,due to degraded voltage relay actuation. Subsequent inspections revealed that the cause of the degraded voltage relay actuation was a loose fuse holder in the degraded voltage direct current control circuitry for emergency bus E2.

Reviews performed after the March 6, 1986 occurrence revealed that the loose fuse holder could have caused the loss of emergency bus E2 on January 28, 1986'.

In this case, the operator racking out the EDG B output breaker could have caused sufficient vibration to open the connection in the -fuse holder. If the loose fuse holder did initiate the loss of emergency bus E2, then the undervoltage relay fuse addressed above could have blown when the.E2 bus was re-enerpized.

Because of the events that occurred, it was not easily discernable which one of the above two possibilities was the actual initiator.

Loss of Offsite Power Extensive investigations were performed to determine the cause of the loss of offsite power. The plant trip caused a normal transfer of the unit auxiliary transformer loads, including emergency buses El and E2, to the startup transformer. However, coincident with this transfer, the C phase differential relay associated with the startup transformer operated. This relay tripped the 115Kv West bus lockout relay which isolated the West bus and startup transformer by opening all of their source and load supply circuit breakers (see Figure 1).

Following the event, equipment and.possible conditions that could have resulted in isolation and lockout of the startup transformer were systematically tested and examined. Some of the tests and inspections that were performed included testing oil samples from the startup transformer, setpoint checks and bench testing of the transformer relays, inspection of associated circuit breakers and related buses, and breaker coordination testing of the auxiliary transfer system. During the course of these activities, all aspects of equipment, equipment inputs, and actual conditions present were analyzed. None of these activities identified any faulted conditions or component failures which could have contributed to this occurrence. However, data collected during breaker coordination testing revealed a condition as described below.

Calculations using numerical data obtained by monitoring the installed equipment revealed that the three current transformers on the primary side of the startup transformer were susceptible to direct current (DC) saturation. These CTs provide the primary (115Kv) side input to the three differential relays. If a primary CT were in saturation, the differential relays could sense a sufficient differential current (30 to 35 percent) across the startup transformer, thus leading to an equipment protective action (isolation and lockout of the 115Kv West bus and startup transformer).

DC saturation of a CT results from a DC component of the in-rush alternating current during loading of the startup transformer at the time plant auxiliaries and other loads are transferred. Briefly, CT staturation begins to

-6 occur when further increases in the-magnitude of the current flowing in the conductor which passes through the CT center does not result in a proportional increase in the time rate of change of the magnetic field around the CT winding.

This decrease in the 'derivative (with respect to time) of the magnetic field around the CT winding results in a.decrease in the voltage induced in this winding. The voltage decrease in turn leads to a decrease in the current flowing in the CT winding. Susceptibility of a CT to DC saturation is a function of voltage rating of the CT, the current present during the in-rush condition, and the resistance of the CT circuit. Although this susceptibility is a function of circuit and equipment design and may have been present through out the operating history of Robinson Unit 2, conditions in the past had not resulted in CT saturation to the extent necessary to operate a differential relay. Thus during the transfer on January 28, 1986 there'were apparently conditions present which had not been present during past transfers. This conclusion is supported by the fact that a West bus lockout had not previously occurred during the approximate 15-year operating history of the Robinson Unit 2 plant.

Conditions present on January 28, 1986 that apparently contributed to the saturation of the primary side C phase CT were as follows:

1. Carolina Power & Light system voltage profile had been increased in November 1985. Additionally, the Robinson Fossil Unit was operating at full load that morning. This resulted in a "stiffer" system (i.e.,

lower system impedance with the attendant ability of the system to supply more current.at a given voltage level) which would tend to make in-rush current effects more predominant.

2. Auxiliary loads at Robinson had slowly increased over the years due to backfit modifications and was slightly higher on that morning due to freeze protection circuits along with other equipment being energized as a result of the cold weather.

3. The freeze protection circuits created a higher than usual resistive load which tended to slow down motors more rapidly during the dead bus period which occurs during transfer. The transfer of auxiliary and other loads is accomplished by a break-before-make scheme resulting in an approximate 6 or 7 cycle dead bus time. As the resistive load slows the motors down, the phase angle increases between the residual motor load and the system. This will further increase the magnitude of the current in-rush and its DC component.

The combination of these conditions on January 28, 1986 likely resulted in DC saturation of the primary side C phase CT which caused the C phase differential relay to actuate. The C phase differential relay was identified during bench testing to be the most likely of the three relays to operate under these conditions.

Corrective Actions There were three principal corrective actions taken immediately following the event. These actions were as follows:

1. The potential transformer (PT) circuitry for both the undervoltage and degraded voltage relays was determined to be susceptible to

-7 random fuse failure. As such, these circuits were modified so as to increase the rating of the PT primary side fuses and to eliminate fuse protection.or the PT secondary side.

2. The susceptibility of the primary side CTs (115Kv) to DC saturation was eliminated by a modifichtion which essentially increases the rating of each CT (increased turn rqtio).

Electrically this modification connected a second CT (for each of the three phases) in parallel with the connected CT and was accomplished by rewiring selected circuits that were physically located in a panel box on the side of the startup transformer.

3. An evaluation was initiated to determine a better method to fuse the direct current control circuits which are associated with the degraded voltage relays so as to prevent or minimize the loose fuse holder problem.

Addendum During the.week of February 17, 1986, the 115/4Kv startup transformer differential relay input CTs were evaluated for susceptibility to DC saturation during transfer of auxiliary loads from the unit auxiliary transformer to the startup transformer. Using the best estimated data available at the tine, the 4000/5 ampere CTs on the 4Kv side to the startup transformer were determined not to be susceptible to DC saturation. Follow-up review of all data developed during the initial investigations included refinement of original calculations to account for a hypothetical worst case scenario. During these activities, 4Kv side CT nameplate data was provided to the manufacturer with a request for its voltage versus current characteristic curve. This characteristic curve was obtained on August 5, 1986. Significant parameters determined from this curve indicated that the preliminary calculations made in February were in error.

The new calculations indicated that the 4Kv side CTs were also susceptible to DC saturation. To assure correct input data was being used, the 4Kv side CTs were actually tested (using equipment not available at the plant site in February) to obtain voltage versus current characteristic curves. The test results confirmed the accuracy of the characteristic curve provided by the manufacturer and thus susceptibility of the 4Kv side CTs to DC saturation was clearly established on August 7, 1986.

At this time, it was recognized that the best permanent solution would involve installation of CTs with improved characteristics. However, such CTs would require special design and construction and would involve a lead time of several months. In order to provide an interim solution, a 10 cycle time delay in the trip path from the startup transformer differential relay output contact to the 115Kv West bus lockout relay was installed. This would ensure that if DC saturation were to occur, approximately 5 cycles would be allowed for saturation decay. Since the relay differential scheme provides no direct safety-related function, a 10 cycle time delay in the protection should not create a safety concern. The installation of the 10 cycle time delay was completed on August 8, 1986. In addition, replacement of the 4000/5 ampere CTs should occur during calendar year 1987.

-8 Safety Significance The principal safetycsignificance of the situation described above is that loss of offsite power to thle emergency buses could occur at a time when needed to operate important safety equipment. Such a loss of power to the emergency buses could be caused by DC saturation of current transformers (CTs)-which form a part of the startup or reserve power transformer protective differential relay circuitry.

Potential Generic Applicability Searches of the Sequence Coding and Search System data base were performed in order to determine if other similar events or situations involving DC satura tion of CTs associated with power transformer differential relay circuitry had been reported at any other plants. These searches did not result in the identification of any other similar events or situations.

Even so, susceptibility of CTs to DC saturation is likely to exist at some other stations, because the specific set of circumstances and/or conditions necessary for it to be clearly established are unlikely to have occurred.

This conclusion is supported in part by the fact that H. B. Robinson Unit 2 had operated for approximately 15 years without CT saturation occurring to the extent necessary to operate a startup transformer differential relay. For this reason and in view of the potential safety significance associated with this problem, IE, with input and assistance from AEOD, prepared and issued IE Information Notice 86-87, "Loss of Offsite Power Upon an Automatic Bus Transfer" in October 1986 to alert all operating nuclear plants of the potential problem.

FINDINGS AND CONCLUSIONS Based on the information presented in the discussion above, the following findings and conclusions are provided:

1. The H. B. Robinson event illustrates how loss of offsite power to emer gency buses may occur in auxiliary power system designs in which power to the emergency buses is transferred from a unit auxiliary transformer to an alternate transformer following a reactor trip/turbine generator trip.

There are many operating nuclear stations with auxiliary power systems which are designed to operate in this manner. For these auxiliary power system designs, the Robinson event clearly has safety significance since following an accident the emergency buses must be transferred to an alter nate transformer in order for the preferred power source (offsite power) to provide power to operate safety-related electrical equipment.

2. In view of the potential safety significance of isolation and lockout of the West bus and startup transformer, the Robinson licensee performed extensive investigations to determine the cause of these occurrences.

These investigations revealed that isolation and lockout of the startup transformer had occurred due to actuation of its protective differential relay circuitry. The startup transformer protective circuitry had apparently actuated due to DC saturation of an attendant CT located on the primary side (115Kv) of the startup transformer. In essence, DC saturation of a CT begins to occur when further increases in the magnitude

9 9

of the current flowing in the conductor which passes through the center of the CT does not result in a proportional increase in the time rate of change of the magnetic field around the CT winding. With a decrease in the time rate of change of the magnetic field around the CT winding, the magnitude of the induced voltage in the winding decreases. This leads to a decrease in the magnitude of *the current flowing in this winding.

Thus the appearance of a currefit imbalance between the current flowing into the startup transformer (as sensed,by the 115Kv CT) and the current flowing out of this transformer (as sensed by the 4Kv CT) is sensed by the differential relay. Although no such imbalance actually exists, if the sensed imbalance is of sufficient magnitude, the differential relay will actuate, causing isolation and lbckout of a startup or reserve power transformer (loss of offsite power).

3. While susceptibility of CTs to DC saturation is a function of CT design and attendant circuit design, the Robinson event-clearly illustrates that grid system conditions along with th'e magnitude of the auxiliary load in rush current during the transfer are also influencing factors. More specifically, loss of offsite power due to DC saturation of a CT associated with a startup or reserve transformer protective differential relay is more likely to occur at stations with a stiffer grid system (thaf is, the ability of the system to supply a larger amount of current before voltage reduction occurs) at the time during a transfer in which the magnitude of the auxiliary load in-rush current is greater than usual.

4. DC saturation of CTs associated with power transformer protective relaying does have potential generic implications. As the Robinson event illus trated in part, such a situation may exist many years prior to an actual occurrence which permits detection. In view of this and the safety signi ficance associated with loss of offsite power, IE Information Notice 86-87, "Loss of Offsite Power Upon an Automatic Bus*Transfer" was issued during October 1986.

SUGGESTED ACTION In view of the action already taken by IE, it is suggested that NRR consider the Robinson event as appropriate during ongoing licensing reviews and to consider incorporating this event into the next revision of Standard Review Plan Section 8.2.

Further, it is suggested that these activities focus on the potential for the occurrence of DC saturation of CTs associated with startup or reserve power transformer protective differential relay circuitry.