05000247/LER-2016-002

LER-2016-002, Automatic Actuation of Emergency Diesel Generators (EDGs) Due to 480 VAC Bus Undervoltage Condition and Loss of Residual Heat Removal (RHR) While in Cold Shutdown

Indian Point 2
Event date:	03-07-2016
Report date:	02-28-2017
Reporting criterion:	10 CFR 50.73(a)(2)(v)(B), Loss of Safety Function - Remove Residual Heat 10 CFR 50.73(a)(2)(iv)(B), System Actuation 10 CFR 50.73(a)(2)(iv)(A), System Actuation
Initial Reporting
ENS 51775	10 CFR 50.72(b)(3)(iv)(A), System Actuation
2472016002R01 - NRC Website

LER 16-002-01 for Indian Point, Unit 2 Regarding Automatic Actuation of Emergency Diesel Generators (EDGs) Due to 480 VAC Bus Undervoltage Condition and Loss of Residual Heat Removal (RHR) While in Cold Shutdown

ML17062B008
Person / Time
Site:	Indian Point
Issue date:	02/28/2017
From:	Vitale A J Entergy Nuclear Northeast
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
NL-17-030 LER 16-002-01
Download: ML17062B008 (8)

Note: The Energy Industry Identification System Codes are identified within the brackets {}.

DESCRIPTION OF EVENT

On March 7, 2016 at approximately 10:18 hours, with Indian Point Unit 2 in Cold Shutdown, Mode 5, Operations test personnel were performing set-up activities for surveillance procedure 2-PT-R084C, "23 EDG 8 Hour Load Test," when the normal supply breaker to 480 Volt AC Bus {ED} 3A tripped on overcurrent. This caused both 480 Volt AC Buses 3A and 6A to de-energize since, as part of the load test set-up activities, the tie breaker (3AT6A) between Buses 3A and 6A was required to be closed and the normal supply breaker for Bus 6A was required to be opened. The 8-hour load test was designed such that 23 EDG would power the loads on 480 Volt AC Buses 3A and 6A simultaneously. Approximately 14 minutes after cross-tying Bus 3A to Bus 6A and opening the Bus 6A normal supply breaker, the normal supply breaker to Bus 3A tripped on overcurrent. This resulted in a loss of assigned loads for both Bus 3A and 6A including 21 and 22 Residual Heat Removal (RHR) {BP} pumps, and 21 Spent Fuel Pool (SFP) {DA} pump. Technical Specification LCO 3.4.7 requires one RHR loop to be operable and in operation, and either the non-operating RHR to be operable and capable of being powered, or the secondary side water level in at least two steam generators to be greater than or equal to 0-percent narrow range. Technical Specification 3.4.7 Condition C was entered and operations personnel immediately initiated actions to restore one RHR loop to operation. There were no SSCs that were inoperable at the beginning of the event which contributed to the event. As designed, 21, 22, and 23 Emergency Diesel Generators (EDGs) {EK} received automatic engineered safety feature (ESF) start signals because of the loss of voltage on 480 Volt AC Bus 6A. As part of the load test set-up activities 23 EDG had already been running, although not tied to Bus 6A yet. At the time that both RHR pumps were de-energized, 24 Reactor Coolant Pump (RCP) {AB} was in operation and providing forced circulation in the reactor coolant system. The Main Steam System {SB} was available and the steam generators were coupled (i.e. pressurizer level and steam generator levels were adequate) thus decay heat removal was never lost. All 480 Volt AC buses re-energized automatically by design, with the exception of Bus 3A. Bus 3A had an overcurrent lockout that prevented 22 EDG from automatically loading onto the bus. At approximately 10:19, 22 RHR pump was started to restore RHR cooling. This event was recorded in the Indian Point Energy Center corrective action program as CR-1P2-2016-01256.

On March 7, 2016 at approximately 11:32 hours, before operators were able to complete the restoration of the normal supply power to Bus 3A, 23 EDG un-expectantly tripped on overcurrent. This resulted in a second automatic EDG engineered safety feature start signal which de-energiZed 480 Volt AC Buses 5A, 2A, 3A and 6A, and generated a start signal to the EDGs. This event was recorded in the Indian Point Energy Center corrective action'program as CR-1P2-2016-01260. Both loops of RHR cooling were lost because of 480 Volt AC Buses 3A and 6A being de-energized. At approximately 11:35 hours, Operations personnel manually started 21 RHR to restore residual heat removal capability as required by Technical Specification 3.4.7 Condition C.

On March 9, 2016 at approximately 20:41 hours, Operations test personnel had Commenced surveillance test 2-PT-R014, "Automatic Safety Injection System Electrical Load and Blackout Test". During the test, the voltage on 480 Volt AC Bus 6A dropped to approximately 200 volts when 23 Auxiliary Feedwater (AFW) Pump was sequenced to the bus. This event was recorded in Indian Point Energy Center corrective action program as CR-IP2-2016-01430.

On March 11, 2016 further investigation of the condition concluded that the automatic voltage regulation (AVR) system for 23 EDG was not functioning properly.

The AVR was replaced and 23 EDG was tested successfully and declared operable. The specific failure mechanism in the AVR was under investigation by a vendor. This condition was recorded in Indian Point Energy Center corrective action program as CR-IP2-2016-01260.

The onsite AC power distribution system includes 480 Volt AC Buses 5A, 6A, 2A and 3A which are divided into three safeguards power trains. The three safeguards power trains are Train 5A (Bus 5A and 21 EDG), Train 6A (Bus 6A and 23 EDG), and Train 2A/3A (Bus 2A and 3A and 22 EDG). The 480 Volt AC buses receive power from 6.9 kV bus sections through their respective Station Service Transformer {FK} (SST) or from associated onsite EDGs. The 480 Volt AC buses are designed with protection against undervoltage (UV) and degraded grid voltage (DGV) using relays that sense UV or DGV conditions.

In Mode 5 with the reactor coolant system (RCS) loops filled, the reactor coolant is circulated by means of two RHR loops connected to the RCS, each loop containing an RHR heat exchanger, an RHR pump, and appropriate flow and temperature instrumentation for control, protection, and indication. One RHR pump circulates the water through the RCS at a sufficient rate to prevent boric acid stratification.

The number of loops in operation can vary to suit the operational needs. The intent of LCO 3.4.7 is to provide forced flow from at least one RHR loop for decay heat removal and transport. The flow provided by one RHR loop is adequate for decay heat removal. The other intent of LCO 3.4.7 is to require that a second path be available to provide redundancy for heat removal.

Cause of Event

The direct cause of the event that occurred on March 7, 2016 at approximately 10:18 hours was a loss of power to 480 Volt Bus 3A when the normal supply breaker from Station Service Transformer (SST-3) tripped on overcurrent due to excessive loads energized on Bus 3A and Bus 6A. As designed, this caused the 480 Volt AC buses to strip loads, resulting in the loss of both 21 and 22 RHR Pumps, 21 SFP Pump, lighting and various other loads.

The apparent cause was inadequate guidance in 2-PT-R084C resulting in excessive loads energized on Buses 3A and 6A. Procedure 2-PT-R084C contained a precaution and limitation to limit current on the 3AT6A cross tie breaker but contained no guidelines on limiting current on the Bus 3A normal supply breaker (i.e. breaker overcurrent trip point was listed but this was for information only and there are no meters where this current can be read). At the time, SST-3 was carrying approximately 260 amps.

Procedure 2-PT-R084C was subsequently revised to include a precaution and limitation to maintain SST loads less than 200 amps.

The direct cause for the second transient that occurred on March 7, 2016 at approximately 11:32 hours was determined to be cracked solder connections on the 23 EDG AVR circuit card. Following a microscopic inspection of the solder joints for the magnetic amplifier by the vendor, it was determined that all nine terminals for the Ll magnetic amplifier exhibited solder cracking. Based upon the cyclic heating and cooling of the Ll magnetic amplifier, it was concluded that thermal growth of the Ll magnetic amplifier relative to the card could have caused cyclic stress on the solder joints. TherefOre, thermally-induced stress is the most likely cause of the solder joint cracks. The apparent cause was the failure to establish a PM strategy in accordance with a Part 21 notification and vendor's maintenance bulletin for the AVR card defect. Based on the intermittent nature of this failure in addition to elimination of all remaining potential causes, it is with high confidence that the cause for the overcurrent trip event which occurred on March 7, 2016 was the result of the intermittent symptoms associated with the degraded connections on the AVR assembly.

This condition was recorded in the Indian Point Energy Center corrective action program (CAP) as CR-1P2-2016-02944.

Corrective Actions

The following corrective actions have been or will be performed under the Corrective Action Program (CAP) to address the causes of this event.

• Revised 2-PT-R084A, B and C to include maintaining SST loads less than 200 amps.

This revision also added critical steps, one of which is verifying that SST load will be less than 200 amps after bus cross-tie is performed.

• The entire scope of Operations test activities was reviewed. Activities that had an impact on a shutdown key safety function were identified and reviewed to ensure that procedure quality was adequate.

• Past operability of 23 EDG was assessed. The AVR assembly was removed from 23 EDG and was tested successfully in accordance with the manufacturer's factory acceptance testing procedures the results from the vendor's surveillance tests, there was tripping on March 7, 2016.

Event Analysis

in spite of the cracked solder joints. Based upon failure analysis and previous satisfactory no indication that 23 EDG was inoperable before The event is reportable under 10 CFR 50.73(a)(2)(iv)(A). The licensee shall report any event or condition that resulted in the manual or automatic actuation of any system listed in 10 CFR 50.73(a)(2)(iv)(B). The systems to which the requirements of 10 CFR 50.73(a)(2)(iv)(A) apply include (#8) Emergency AC electrical power systems including emergency diesel generators. The actuation and start of the EDGs on the two occasions on March 7, 2016 at 10:18 hours and 11:32 hours meet the reporting criteria.

Pursuant to 10 CFR 50.73(a)(2)(v)(B), the loss of both 21 and 22 RHR loops was not considered to be a loss of safety function needed for residual heat removal, since at least one RHR pump was always capable of being powered by either the onsite or offsite power sources.

In accordance with 10 CFR 50.72(b)(3)(iv)(A), on March 7, 2016, at 17:12 hours, an eight hour non-emergency notification (#51775) was made for an event or condition which resulted in a valid actuation of the EDGs. The event was recorded in the Indian Point Energy Center corrective action program (CAP) as CR-IP2-2016-01256.

Past Similar Events

A review of the past five years of Licensee Event Reports (LERs) for events reporting valid Emergency Diesel Gerierator automatic actuations occurring during surveillance testing did not find any similar events.

Safety Significance

This event had no safety consequences on the health and safety of the public. In general, when the unit is shut down, the Technical Specifications requirements ensure that the unit has the capability to mitigate the consequences of postulated accidents.

However, assuming a single failure and concurrent loss of all offsite or all onsite power is not. required. The rationale for Xhis is based on the fact that many Design Basis Accidents (DBAs) that are analyzed in MODES 1, 2, 3, and 4 have no specific analyses in MODES 5 and 6. Worst case bounding events are deemed not credible in MODES 5 and 6 because the energy contained within the reactor pressure boundary, reactor coolant temperature and pressure, and the corresponding stresses result in the probabilities of occurrence being significantly reduced or eliminated, and have minimal consequences.

There were no actual implications from the event since there were no DBAs or radiological releases. During this event there were always two EDGs capable of supplying two safeguards power trains of the onsite AC electrical power distribution subsystems. Power from the offsite sources was available, and the ESF actuation circuitry and EDGs performed in accordance with design. The minimum safeguards power was available to power safety loads. At the time that both RHR pumps were de- energized, 24 Reactor Coolant Pump (RCP) was in operation and providing forced circulation in the reactor coolant system. The Main Steam System {S13} was available and the steam generators were coupled (i.e. pressurizer level and steam generator levels were adequate) thus decay heat removal was never lost.