ML20086J905
| ML20086J905 | |
| Person / Time | |
|---|---|
| Site: | Fort Saint Vrain  |
| Issue date: | 01/04/1984 |
| From: | Chiramal M NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD) |
| To: | |
| Shared Package | |
| ML20086J894 | List: |
| References | |
| TASK-AE, TASK-E401 AEOD-E401, TAC-63030, NUDOCS 8401250510 | |
| Download: ML20086J905 (7) | |
Text
-_____________ _____
AE0D ENGINEERING EVALUATXON REPORTO
~
UNIT:
Fort St. Vrain EE REPORT NO: AE0D/E401 DOCKET NO:
50-267 DATE: January 4, 1984 LICENSEE:
Public Service Company EVALUATOR CONTACT:
M. Chiramal of Colorado NSSS/AE: Gulf General Atomic / Sergent & Lundy
SUBJECT:
TEMPORARY LOSS OF ALL AC POWER DUE TO RELAY FAILURES IN DIESEL GENERATOR LOAD SHEDDING CIRCUITRY (LER 83-18)
SUMMAPY
~~~
On May 17,1983 with the reactor shutdown and the 1A Emergency Diesel Generator (EDG) set out of service for maintenance, and the 1B EDG set running and tied to the 1C 480V Essential Bus, severe weather conditions caused a loss of all of fsite power to the station.
Consequently, the 1B EDG output breaker opened due to overloading.
Failure of two time delay relays in the load shedding circuit of the EDGs prevented _ automatic re-energization of the electrical loads connected to the 480V Essential Buses.
This resulted in virtually a total loss of all ac power to the station.
Plant operators took immediate corrective actions by manually resetting the load shedding relays (by pulling out the appropriate control circuit fuses) and re-energizing the 1C and 1B 480V~E_ssential Buses by the way of the IB EDG and re-establishing the requirea essential loads within approximately twenty-five minutes.
Forty-five minutt.
af ter the loss of of fsite power, the 1A EDG was also returned to operation and the 1 A 480V Essential Bus and loads were energized.
An hour later offsite power was restored and the 1A and 1B EDGs were returned to their normal standby condition.
Investigation of the event by the licensee revealed the coil f ailure of two time delay relays used in the load shedding circuit of the EDGs.
It was also revealed that existing procedures did not incorporate testing of these relays as individual components.
Hen:e these failures would have remained undetected. The licensee has developed new testing procedures for routinely testing these relays and thus detecting similar f ailures.
The licensee has not determined when the relays failed or the root cause of the f ailures.
Based on our eview of the event, we believe that the possibility exists that the relay failures occurred while the 1B EDG was being operated in parallel with the plant electrical distribution system which in turn was being supplied by the troubled offsite power sources.
We believe that the practice of connecting EDGs in parallel with the offsite rower sources when the offsite power sources are undergoing grid problems, has the potential for compromising the onsite emergency power. sources (i.e., the EDGs).
We see no advantage in such an operating philosophy.
For, at Fort St. Vrain, as soon as offsite power was lost the operating E0G's breaker opened on overload and disconnected from the emergency buses causing a total loss of all ac power to the station.
An alternative would have been to start the EDG and run it unloaded or have.it supplyirg the emergency-buses XA Copy Has Been Sent to POR
- This document supports ongoing AEUD and NRC activities and does not represent
~
the position or requirement. of the responsible NRC program office.
C x n m%
u e
i
~
with the emergency buses disconnected from the offsite sources.
Such a mode of operation would minimize the interaction between the grid system and the emergency power sources. The practice of running the EDGs in parallel with a troubled grid system may be prevalent at other operating nuclear plants too. We feel that such practices should be reconsidered and recommend that the details of the event at Fort St. Vrain and the lessons learned from it be conveyed to other operating nuclear plants for infomation and appropriate actions. To meet the intcnt of 10 CFR 50, Appendix A, GDC 17, regarding independence of the onsite electric power supplies, we believe that 'a Technical Specification recuirement prohibiting the parallel operation of the onsite electric power supply with the grid should be considered for all nuclear power plants.
DISCUSSION At 0930 hours0.0108 days <br />0.258 hours <br />0.00154 weeks <br />3.53865e-4 months <br /> on May 17, 1983, the offsite power system at Fort St. Vrain started developing problems due to severe weather conditions (high winds and snow). The reactor and turbine-generator were already in the shutdown condition at this time. At 1113 hours0.0129 days <br />0.309 hours <br />0.00184 weeks <br />4.234965e-4 months <br /> the 1B EDG was started and tied to the 1C 480V Essential Bus as a precautionary measure (the 1A EDG was out for maintenance during this time).
At 1145 hours0.0133 days <br />0.318 hours <br />0.00189 weeks <br />4.356725e-4 months <br /> all offsite power was lost to the station and the IB EDG output breaker tripped apparently on overl oad.
At this point the plant was virtually without any ac power (inverters powered by the de system were still avai' able).
Normally on a loss of offsite power and turbine trip, the EDGs start and load shedding relays actuate to strip the 480V Essential Buses of all electrical loads. The load shedding relays are then automatically reset when voltage on either the 1A or 1C 480V Essential Bus is re-established via the respective EDG set. Essential loads are then picked up by the load sequencer associated with the EDG set.
At Fort St. Vrain the load shedding-circuit for each EDG includes four (4) time delay relays (227-1A and 1C that monitor loss of voltage on lA 480V Essential Bus and 227-3A and 3C that monitor loss of voltage on 1C Essential Bus).
During this event two of these relay,s h IB EDG had re-_qn_erci_ zed the 1C 480V Essential Bus. gnercized even af ter t eihe other two relays (22
( g 3A and_3C Lr,emaigned_de de-energTz~ersinYe'~tliFTA Bus had no power (loss of of fsite power and 1A EDC ~
out of service).
With all four relays de-energized the load shedding circuits l
remained in the tripped state (energized) and prevented the loads on the IC and IB 480V Essential Buses from sequencing on as designed. The plant operators then manually resct the load shedding relays by removing the control circuit fuses associated with the load shedding circuit of IB EDG.
(The operators precaution of placing the hand switches controlling significant' had taken thu loads on the essential buses in the " Pull-to Lock" position-to ensure conplete control of the loads once the buses are re-energized by 1B EDG.)
Subsequent investigation of. the event by the licensee revealed _that the coils of time delay relays 227-3A and 227-3C had f ailed. The caus'e of failure or A
the point in time at which the' coils had failed were not detemined.
review of existing test procedures for the diesel generators found that due_
to procedural inadequacy these time delay relays are. not tested as individ_ual.
t hus,-the f aiTurprof these _ relays would remain components on a requiar nas'ff 9
undetected during nonnal surveillance testing. Daly due to the uniqueness of the event were the coil f ailures discovered. The licensee subsequently tested all four time delay relays and has replaced the faulty ones.
A new procedure for testing these relays has been deveioped by the licensee and was implemented in July 1983.
Based on our review of the design of the load shedding circuits at Fort St. Vrain, we believe that the use of these time delay relays, in the above described configuration, is unique to Fort St. Vrain and, hence, has no implications on other nuclear power plants.
Based on our review of the event and the corrective actions taken, we consider the immediate operater actions taken during the event to be exempl a ry. The new focedures developed will assure that the failures of the time delay relays are detected during routine testing.
We also reviewed _the event for its generic implications that would apply to other nuclear plants oper: ting under similar circumstances. The relays that failed at Fort St. Vrain were voltage monitoring relays on the 3C 480V Essential Bus.
Prior to and at the time the loss of offsite power occurred,1B EDG was running tied to this bus and operating in parallel with the plant electric distribution system which was being supplied by the offsite power system.
It is possible that the failure of these relays could have been caused by this operating configuration. Voltaae suroes u,ombi_ned with voltage propagated f rom the unstable _ofhi_te,gr_id_ system c
transients at_the_(ifGWuld,have caused or contributed to th relay,,
Tal t ures. ~ Tin reviewing the operating experiences at Fort SI. Vrain it was noted that on May 20, 1983, the output breaker for 1B EDG set was inadvertently closed with the diesel generator secured and damage to the-surge protector of the EDG occurred. It is possible that although the failure of the surge protector occurred on May 20, 1983, the voltage surges experienced during the May 17, 1983 event may have contributed to the f ailure.)
In any case the operation of the onsite emergency power source (i.e., the EDG,) in parallel with an unstable grid system, we feel, compromises the onsite emergency power source, since the problems in the ~
of fsite power source could propagate to the onsite emergency system and adversely a ffect its operation. The potential adverse effects are:
- 1) the EDGs.would be exposed to voltage surges propegating from the troubled of fsite power system which could potentially cause immediate-or _._._
cumulative damage to the EDGs and associated components, 2) the EDGs-would be over1oaded if a 1oss of offsite power was to occur and would require the proper functioning of the -EDG's protective. circuits to separate the EDGs from the plant's electrical distribution system, and 3) the subsequent restoration of the emergency onsite power system would require the proper functioning of the automatic load shedding and load sequencing circuits whose components may have been exposed to the voltage surges in item 1 above. Our review cf operating experiences and practices shows that there is variation in the methods of operation of the onsite emergency power sources at cperating nuclear plants during situations when the of fsite power system is experiencing problems (e.g., hurricanes, extreme weather conditions, forest fires, degrading grid situations etc.).
i The method of parallel operation at Fort St. Vrain may be used in other nuclear power plants as well.
(See Appendix for a brief description of l
some events involving operation of onsite power sources while the offsite-power system was experiencing difficulties.)
~
~. _ _
We can find no advantage in this type of operation.
For, as seen at Fort St. Vrain, when offsite power is lost, the EDG tends to overload and wili E(yFy ',
either trip or disconnect from the emergency bus. Thus the intent of this
/
operating configuration - that of maintaining the plant's emergency loads energized when offsite power is lost - is not attained.
By aligning the onsite emergency power sources in parallel with the offsite power system that is experiencing difficulties, the emergency power sources could also be subjected to the problems affecting the offsite power system.
These could prevent the proper functioning of the onsite power sources, so that when.offsite power is subsequently lost, a total-loss of all station ec power (i.e., blackout) could occur. A viable -alternative would be to start t'te EDGs when offsite power problems are encountered and keep them running unloaded ready to energize the essential buses when of fsite power is lost and taking appropriate actions to prevent potential problems associated with unloaded operation of the EDGs.
Another method would be to start the EDGs and energize the associated emergency buses and loads, and then isolate the emergency system from the offsite source.
Such methods of operation that keep the onsite emergency power system and/or sources isolated from the of fsite power system that is experiencing problems, would tend to minimize adverse interactions between the two systems.
It should be noted that Fort St. Vrain, being an HTGR unit, was maintained, without too much difficulty, in a safe shutdown condition during the period of time when all ac power was lost.
A light water reactor (LWR) unit, under similar total loss of ac power condition, would require greater operator efforts to be maintained in a safe shutdown condition. Therefore, LWR plants should be more cautious in their operating procedures to reduce the possibility of total loss of ac power.
10 CFR 50, Appendix A, GD017 requires the onsite electric power supplies to have sufficient independence, redundancy, and testability to perfom their safety functions assuming a single failure. To meet the intent of these requirements, we believe that Technical Specifications prohibiting the parallel operation of the onsite electric power supply with the electric distribution system under all conditions of operation should be considered for all nuclear plants.
(This would not, of course, apply to the obvious conditions of parallel operation during surveillance testing of tne EDG units or during emergency operating conditions when nomal offsite power is being restored following a loss of of fsite power event.)
We noted that the Standard Review Plan, Section 8.3.1 and Branch Technical Position ICSB 8(PSB),
does set forth the basis for prohibiting the parallel operation oldie _sel generator sets for purposes other than emergency standby power supplies, but does not specifically prohibit such operation for the purpose of emergency standby power supplies.
However, the basis in the Branch Technical Position does equally apply to parallel operations of diesel generator sets for any purpose.
FINDING Based on the discussion above the following findiags were obtained:
1.
The reactor was maintained in a safe shutdown condition throughout the duration of the event.
2.
When severe weather conditions were experienced at Fort.St. Vrain, the available emergency diesel generator set (EDG-1B) was started and tied to the 1C a80V Essential Bus.
The of fsite power system was experiencing several problems during the time the IB EDG was operating in p'arallel with the of fsite power system.
When of fsite power was lost, the IB EDG
output breaker tripped open. The 13 EDG re-energized the associated IC 480V Essential Bus as designed, but the associated load shedding i
relays did not automaticaly reset due to failure of certain relays -in the load shedding circuit.
The failure in the load shedding ' circuit of 1B EDG prevented autonatic re=energization of the essential elec-trical loads on 1C and IB 480V Essential Buses as designed. Prompt actions by plant personnel allowed manual resetting of load shedding relays and controlled reloading onto 1C and 1B 480V Essential Buses.
I During this period the plant was virtually without ac power for approxi-i mately twenty-five minutes.
The second diesel generator ~ set (1A EDG) which was out for maintenance was returned to service within forty-five minutes af ter the loss of offsite power. An hour later offsite power was returned I
to the station and the EDGs were returned to their norm &1 standby conditions.
j 3.
Investigation of the event by the licensee found that the failure of the load shedding circuit was due to coil failures of two of fcur time delay relays used in thnt circuit. The licensee has not determined the cause of the f ailures or the point in time at which the failures occurred. The licensee also found that due to a procedural inadequacy these time delay' relays, associated with the 1A and 1B EDGs, are not tested as_ individual components on a regular basis.
The licensee has developed and implemented new procedures for testing these time delay relays.
Our review of the-design of. the load shedding circuits of Fort St. Vrain diesel cenerator i
units, found the configuration of these time delay relays to be unique _ to Fort St. Vrain.
CONCLUSION 1.
The actions taken by the plant operations personnel,-in-diagnosing and correcting the failure of the load shedding circuit of 1B EDG, were excellent.
The long term corrective action taken by the licensee in -implementing new.
4 procedures for routinely testing the time delay.r'elays will assure that failures of these relays are detected.
~
2.
By operating the 1B EDG in parallel with the station' electric distri-bution system while the offsite power systen wasfexperiencing diffi -
culties, we believe that the independence and operability of the_ o,nsite_.
power source (EDG) was compromised. ' Operating experience has shown-that.
this method of operation,. i.e., rua.ing the: emergency onsite power sources in parallel with an offsite power system that :is experiencing difficulties, is practiced at-other r.uclear plants too.
, RECOMMENDATIONS Based on-our review of the loss of offsite power event at Fort St. Vrain;
~
on May 7,1983, _.we feel ~ that the. practice of - running the. onsite emergency power sources '(i.e., the EDGs) in parallel; with the;offsite power. system :
while3it is ~ experiencing difficulties, should be reconsidered by all ~ operating-
~
nuclear plants.
Hence we recommend that the details off the event at FortLbt.
i.
.Vrain and.the findings and conclusions. of this' report -be conveyed' to other operating nuclear plants for their consideration.
We. al so.recommendLthat NRR '
~
_ consider : imposing Technicai -Specification ' requirements. prohibiting the parallel-operation of the onsite el.ectric power-supply with theLel'ectrical distribution ~
system under all conditions-of _ operation, except when necessary. for. serveillance ; *
' testing or toirecover from;cmergency operation:due.to _lcss of, offsitel power.
t
(
a m ---
r s
w w
++m,
APPENDIX
~.__
Events involving Operation of Emergency Onsite Power Sources While Offsite Power System was Being Threatened Plant Brief Event Description Millstone 1 In August 1976, the Gas Turbine Generator and the DG were being run without load as a precaution due to the passing of Hurricane Belle. The Gas Turbine became inoperative wnen the plant tripped during loss of normal ac power due to salt build-up in the 345kV lines and insulators.
An investigation revealed that the trip was due to improper alignment of the feed to the Gas Turbine at auxiliaries, including t;d battery charger.
Millstone 2 During Hurricane Belle, the reactcr tripped due to a loss of offsite power.
All systems operated as designed and the plant was placed in Mode 3 at normal temperature and pressure.
Both DGs had been running prior to the trip and were placed on the line to supply all essential plant loads following the loss of offsite power.
Indian Point 2 At 1545 hours0.0179 days <br />0.429 hours <br />0.00255 weeks <br />5.878725e-4 months <br /> on June 3,1980, while the plant was operating at 100% power, an electrical disturbance was experienced on the Con Ed system whichiresulted in a loss of all offsite power and a unit 7~
shutdown.
Prior to the loss of offsite power, a thunderstorm alert was put. into-effect.
As per normal' procedures prepara-tions were made to put gas turbine GT-1, 2 & 3 in service.
At the time of the disturbance, GT-1 was in service 1caded at 18MW, and GT-2 was in service loaded to 20MW. GT-3 had not yet started.
The subseqt:ent loss of '138kV supply to the-Buchanan substations resulted-in the automatic tripping of. GT-1,' and GT-2. ~ The
. loss of:a11'outside power de-energized 6.9kV buses 5 and 6, and associated 480V busses 5A and 6A.
By design, the emer-gency DGs started upon loss of buses 5
.and 6.
_2
~. _ _
Plant Brief Event Description Rancho Seco On August 7,1981, with the' reactor shutdown, voltage in the switchyard decreased to 206kV due to high den.and for electric'ty in the area. The diesel generators were started and used to supply power to the NSS buses.
Millstone 1 On February 17, 1982, while switching to isolate the northern 345kV line, a circuit switcher 15G-2T-6 faulted phase A to B causing a fire to break out in the circuit switcher. The switcher was cleared by operation of the 383 line relay which automatically disconnected the line and the Reserve Station Service Trans fo rme r.
Technical Specification-3.9.B.2 allows reactor operation provided both emergency power sources are operable and the Isolation Condenser System operable when incoming power is not available from any 345kV line. The Diesel Generator and the Gas Turbine were started and placcd in' parallel with their buses.
m89 1
- l 1
4