ML20248E579
| ML20248E579 | |
| Person / Time | |
|---|---|
| Site: | Palisades  |
| Issue date: | 09/29/1989 |
| From: | Mazumdar S NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD) |
| To: | |
| Shared Package | |
| ML20248E552 | List: |
| References | |
| TASK-AE, TASK-T919 AEOD-T919, NUDOCS 8910050318 | |
| Download: ML20248E579 (4) | |
Text
.. _. _ _. _ _ _ _ _ _ _ _ __ _ - _ _ _ _ _ _ _ _ _ _ _ - _
? .
AE0D TECHNICAL REVIEW REPORT
. UNIT: . Palisades TR REPORT NO.: AE0D/T919 DOCKET N0.: 50-255 DATE: September 29, 1989 LICENSEE: Comsumer Power EVALUATOR / CONTACT: S. Mazumdar y NSSS/AE: Combustion Engineering
SUBJECT:
FAILURE OF OVERCURRENT PROTECTIVE DEVICE AT-PALISADES UNIT 1 EVENT DATE: November 4, 1988
SUMMARY
Between February 5,1987, and November 10, 1988, the three service water pumps at Palisades l' tripped five times on actuation of overcurrent (00) relays. A licensee investigation into spurious trip of these DC relays attributed the root cause to increased pump motor currents due to backfilling of service water pump impellers done in late 1986 and to failure to consider motor service factor in the relay setting calculation.
The licensee evaluation also established that such low OC device settings could cause loss of all service water pumps during high service water demand following a safety injection system actuation. After significant tests and investigations, the licensee has finally resolved the problem by raising the OC relay settings and adding an alarm in the control room to alert the operator to reduce pump load when the motor current was too high.
DESCRIPTION OF EVENT The service water pumps at Palisades are protected by GE IAC66K relays having high drop out-(HD0) and time overcurrent (TOC) trip elements. The HD0 element protects the motor during high inrush current period and the TOC protects the motor after the inrush period.
In late 1986, the licensee backfilled the pump impellers to increase the pump capacity. This caused the motor full load current to increase marginally beyond the relay trip settings resulting in five trips between February 1987 and November 1988. However, none of the trips occurred during testing, making diagnosis of the OC relay trippings difficult. During this period the licensee carried out various tests and investigations to arrive at the root cause. Finally, in mid-November 1988, the licensee arrived at the proper trip setting of the DC relay. In addition, the relay TOC pick up was wired to alarm in~the control room to alert the operator to reduce service water pump flow when the motor current was too high.
SIMILAR EVENT SEARCH Oak Ridge National Laboratory conducted an SCSS search operation of overcurrent trip devices and identified 99 LERs. Our review of these 99 LER abstracts, identified only the following LERs with maloperation of OC protective devices as the root cause.
t 8910050318 890929
4 Plant LER No. Root Cause Surry 1 87-028 Design deficiency - improper L use of instantaneous element.
Robinson 88-123 Design deficiency in cable ampacity calculation.
Salem 2 87-014 Design deficiency in relay co-ordination.
FitzPatrick 84-002 Design. deficiency in relay co-ordination.
FitzPatrick- 85-003 Improper installation.
Salem 1 82-044 OC element drift.
Furthermore, our review of these six LERs indicates that five of the failures are due to human errors and only the last one due to device failure.
We have also carried out an NPRDS search which identified the following OC device failures.
Number of Device Failures OC Device Design Poor Unknown Device Manufacturer Deficiency Maintenance Reason Aging Failure Total Westinghouse 6 8 10 10 27 61 General Electric 4 11 1 4 12 32 ITE 2 2 2 - 5 11 Total 12 21 13 14 44 104 l
It is our impression from a review of these NPRDS brief reports that in most cases the licensees did not pursue an in-depth investigation into the root cause of the OC device failures. Thus, out of 104 failures, they have attributed 12 failures to design errors and 21 failures to poor maintenance. The remaining failures have been attributed to oping (14 cases), unknown cause (13 cases), and device failures (44 cases) without explaining the root cause of device failure.
IMPLICATION OF OC PROTECTIVE DEVICE FAILURE OC protective devices provide the following safety functions:
- a. Limit equipment damage and fire hazard caused by fault current.
- b. Minimize duration of distribution system voltage dips and thereby improve uninterrupted operation of other equipment in the system l
l 1 N
- .. -.3 -
>s . . .
- c. . Reduce step and touch potential, flash hazard,-and noise due to flow of ground fault. current.
~
-To achieve the above objectives, often the protective devices have to operate within a close range of the setpoints.and meet the following conditions:
- a. Co-ordinate with the protected equipment: To protect any equipment the. time. current characteristic curve of the OC' protective. device should be below the' thermal withstand. curve of.the load, but above
- i. the worst case steady state and transient load currents. If the OC device characteristics is too low, it will cause unnecessary tripping of the loads and'if it.is too high it will not protect the load. The worst case is when the OC device setting is marginally high or low.
.When marginally high, the protected' equipment may be damaged during testing or loading without leaving visible indications and may fail on subsequent critical loadings. .When the OC device setting is marginally low, it may not trip under' normal testing but may spuriously trip under full load condition as happened at Palisades 1.
- b. Upstream and downstream coordination: To isolate.only the defective equipment, all upstream and downstream protective devices should be properly co-ordinated. Otherwise, a fault at low level will trip a protective device at a higher level isolating all loads fed from that point.
For these reasons, it is essential that all protective devices in any electrical '
(distribution system should be properly co-ordinated with the driven load and other protective devices. Equally important as the OC device selection criteria is the proper maintenance of these devices, especially against bad contacts,. loose terminal, grease and other foreign objects hindering smooth operation of' protective devices. This should include periodic surveillance tests and timely replacements. Also, to be considered is the reliability of the' 0C protective device and analysis of the faults. In a nuclear plant not 4 all protective device operation provide annunication in the control room and many 0C' protective device failures go undetected except_during surveillance.
Such undetected failures can cause common-inode failures in multiple trains.
This makes.it essential that all Class IE and critical loads should be protected L
by quality protective devices and all failures be investigated for root cause analysis.
1 Dur scrutiny of NPRDS events indicates that in most cases the root cause of the L OC. device failure have not been investigated in-depth. While such in-depth investigations are often time consuming and expensive they should not be
~'
avoided. In an operating plant the essence is continuity of operation which motivates replacement of the defective equipment in minimum time. Field l experience indicates that in most cases where adequately sized OC devices are used, it is possible to continue normal operation by just replacing the damaged OC device with a new one without investigating the root cause of the device failure. This approach has several limitations. Continued operation without rectification of the root cause makes the system prone to repeated spurious service interruptions when the OC device trips too early or leaves protected equipment unprotected when the OC device fails to trip. Furthermore,
p
- ." 4 the root cause analysis is likely to substantially reduce the failure rates of these devices even though the present failures rates are not alarming. In most cases, such investigations can be carried out after replacing the defective device with a new device with no additional delay in plant operation. However, for repeated failures or spurious trips early investigation is desirable to limit equipment demage, fire hazards or nuisance trips. In this respect, it is appropriate to point out that with many OC devices, the actual time current characteristics are different from Vendor's published curves. Another interesting case is when a motor (or a relay coil) is rewound or its load is replaced, the motor current characteristic may change. Without in-depth
. investigations, these type of complications are difficult to resolve.
CONCLUSION Considering the vital part played by OC protective' devices in limiting equipment damage, fire hazard and system blackout, and in improving equipment availability, it is desirable that in the future all Class 1E OC device failures be investi-gated in-depth to establish the root cause of each failure.
1 l
_ - _ - _ - _ _ _ _ _ _ _ - _ _ _ _ _a