2IA

K'

UREG/CR-3122

RNL/NSIC-213

Potentially Damaging Failure Modes

of High- and Medium-Voltage

Electrical Equipment

Prepared by H. C. Hoy

Oak Ridge National Laboratory

Prepared for

U.S. Nuclear Regulatory

Commission
I i

NOTICE

This report was prepared as an account of work sponsored by an agency of the United States

Government. Neither the United States Government nor any agency thereof, or any of their

employees, makes any warranty, expressed or implied, or assumes any legal liability of responsibility for any third party's use, or the results of such use, of any information, apparatus,

product or process disclosed in this report, or represents that its use by such third party would

not infringe privately owned rights.

Availability of Reference Materials Cited in NRC Publications

Most documents cited in NRC publications will be available from one of the following sources:

1. The NRC Public Document Room, 1717 H Street, N.W.

Washington, DC 20555

2. The NRC/GPO Sales Program, U.S. Nuclear Regulatory Commission,

Washington, DC 20555

3. The National Technical Information Service, Springfield, VA 22161

Although the listing that follows represents the majority of documents cited in NRC publications,

it is not intended to be exhaustive.

Referenced documents available for inspection and copying for a fee from the NRC Public Document Room include NRC correspondence and internal NRC memoranda; NRC Office of Inspection

and Enforcement bulletins, circulars, information notices, inspection and investigation notices;

Licensee Event Reports; vendor reports and correspondence; Commission papers; and applicant and

licensee documents and correspondence.

The following documents in the NUREG series are available for purchase from the NRC/GPO Sales

Program: formal NRC staff and contractor reports, NRC-sponsored conference proceedings, and

NRC booklets and brochures. Also available are Regulatory Guides, NRC regulations in the Code of

Federal Regulations, and Nuclear Regulatory Commission Issuances.

Documents available from the National Technical Information Service include NUREG series

reports and technical reports prepared by other federal agencies and reports prepared by the Atomic

Energy Commission, forerunner agency to the Nuclear Regulatory Commission.

Documents available from public and special technical libraries include all open literature items,

such as books, journal and periodical articles, and transactions. Federal Register notices, federal and

state legislation, and congressional reports can usually be obtained from these libraries.

Documents such as theses, dissertations, foreign reports and translations, and non-NRC conference

proceedings are available for purchase from the organization sponsoring the publication cited.

Single copies of NRC draft reports are available free upon written request to the Division of Technical Information and Document Control, U.S. Nuclear Regulatory Commission, Washington, DC

20555.

Copies of industry codes and standards used in a substantive manner in the NRC regulatory process

are maintained at the NRC Library, 7920 Norfolk Avenue, Bethesda, Maryland, and are available

there for reference use by the public. Codes and standards are usually copyrighted and may be

purchased from the originating organization or, if they are American National Standards, from the

American National Standards Institute. 1430 Broadway, New York, NY 10018.

GPO Printed copy price: $4. 50

4
NUREG/CR-3122

ORNL/NSIC-213

Potentially Damaging Failure Modes

of High- and Mediu mr-Voltage

Electrical Equipment

Manuscript Completed: July 1983

Date Published: August 1983

Prepared by

H. C. Hoy

Oak Ridge National Laboratory

Oak Ridge, TN 37830

Prepared for

Office for Analysis and Evaluation of Operational Data

U.S. Nuclear Regulatory Commission

Washington, D.C. 20555

NRC FIN B1672

iii

CONTENTS

Pag~e

FOREWOR]D .......... a................................................ v

ACKNOWLEDGMEITS ... *.............................................. vii

EXECUTIVE SUMMARY ................................................. ix

ABSTRACT ................. ............ . ..... . I

1. INTRODUCTION ................... ............................ 1

2. SYSTEM DESCRIPTION ............................................ 5

3. DATA COLLECTION ......... ..... ................................ 7

3.1 Literature Searches .... .................... ....... ..... . 7

3.2 Personal Contacts .................... ........ ........ ........ 7

3.3 Applicable Codes and Standards ........................... 8

3.4 Plant Visits ............................................ 8

3.5 Doble Clients Conference Proceedings ..................... 10

4. EVENT DESCRIPTION ................................. .......... 11

4.1 North Anna Transformer Failures .......................... 11

4.2 Y-12 Switchgear Failure .. ...... . ..... ... .. ......... 12

4.3 Transformer Fire at ENICO Substation .................... 12

4.4 Brighton Area Breaker Failure ............................ 13

4.5 Fires .............. a.................................... 14

4.6 General Considerations ................................ ... 14

5. EQUIPMENT FAILURE ANALYSIS .................................. 15

5.1 Transformers mm .. . .0 0. .0. .a .. . *............... . 15

5.2 Switchgear .............. . . . d. .. . .a. . .0 0 18.*. i

5.3 Lightning Arrestors ..... ....... .......... ..... a .... .. 20

5.4 Cables and Connectors .... 22

5.5 Control Board ..... .... ............. ......... .......... 24

5.6 Other Equipment ........... ............. ..... . .......... 25

6. MAXIMUM POTENTIAL COMPONENT FAILURE MODES ...................... 26

6.1 Transformers ............. ................ 26

6.2 Circuit Breakers and/or Switchgear ........................ 27

6.3 Lightning and/or Surge Arrestors ......................... 29

6.4 Cables and Connectors ............ *..................... 30

6.5 Control Boards (High Boards) ............................. 31
iv

7. CONSEQUENCES OF COMPONENT FAILURES IN NUCLEAR POWER PLANTS ... 32

7.1 Transformers ......................... *.*. .... .. ..... . 32

7.2 Switchgear ........................... 0.................. 34

7.3 Lightning Arrestors .................................... 34

7.4 Cables and Connectors ........................................... 35

7.5 Control Boards ............... ... ...................... 36

8. DISCUSSION .................................................... 37

9. CONCLUSIONS ..................................... s..... ........ 39

9.1 Transformers ............................ ...... ......... 39

9.2 Switchgear ............... 0...........4................... 39

9.3 Lightning Arrestors ..... ........... .................... 40

9.4 Cables and Connectors ...... ......... . .................. 40

9.5 Control Boards ............ ........ . *..................... 41

9.6 Other Equipment ................... ..................... 41

10. RECOMMENDATIONS ............................................ 42

10.1 General Recommendations ................................ 42

10.2 Recommendations on Specific Electrical Equipment ....... 45

REFERENCES .. . . . . .......... oo.................... ........... ... 48

APPENDIX A. SELECTED CITATIONS FOR EXAMPLES ...................... 51

APPENDIX B. GIDEP SYSTEMS ...................... ... ............. 69

APPENDIX C. BIBLIOGRAPHY ...................................... 73

APPENDIX D. SAMPLE FAILURE REPORTS .............................. 75
V

FOREWORD

The Nuclear Safety Information Center (NSIC), which was established

in March 1963 at Oak Ridge National Laboratory and is a project within

the Nuclear Operations Analysis Center, is sponsored by the U.S. Nuclear

Regulatory Commission's Office for Analysis and Evaluation of Operational

Data. Support for the technical progress review Nuclear Safety is provided by both the Breeder Reactor and Light-Water Reactor Safety Programs

of the Department of Energy. NSIC is a focal point for the collection,

storage, evaluation, and dissemination of operational safety information

to aid those concerned with the analysis, design, and operation of nuclear

facilities. The Center prepares reports and bibliographies and has developed a system of keywords to index the information it catalogs. The

title, author, installation, abstract, and keywords for each document

reviewed are recorded at the central computing facility in Oak Ridge.

Computer programs have been developed that enable NSIC to (1) prepare

monthly reports with indexed summaries of Licensee Event Reports, (2) make

retrospective searches of the stored references, and (3) produce topical

indexed bibliographies. In addition, the Center Staff is available for

consultation, and the document literature at NSIC offices is available 'for

examination. All of the above services are available free of charge to

U.S. Government organizations as well as their direct contractors. NSIC

reports (i.e., those with ORNL/NSIC and ORNL/NUREG/NSIC numbers) may be

purchased from the National Technical Information Service. Persons interested in any of the services offered by NSIC should address inquiries to:

J. R. Buchanan, Assistant Director

Nuclear Safety Information Center

P.O. Box Y

Oak Ridge National Laboratory

Oak Ridge, Tennessee 37830

Telephone 615-574-0391

FTS 624-0391

vii

ACKNOWLEDGIENTS

The author wishes to acknowledge the help of Wm. B. Cottrell and

W. R. Casto of the Nuclear Operations Analysis Center for their careful

technical reviews and worthwhile comments on this report. The cooperation

of the engineering staff at the Tennessee Valley Authority and the College

of Engineering at the University of Tennessee, Knoxville, was invaluable.

ix

EXECUTIVE SUMMARY

The major electrical equipment used in nuclear power generation (see

Fig. I in Chap. 2) is basically the same as that used in coal-, gas-, and

oil-burning plants; however, the nuclear plant's electrical equipment is

often purchased under specifications that include seismic effects and

tighter quality control than the fossil plants, even though the functional

engineering design is the same. Therefore, the literature dealing with

both nuclear and nonnuclear thermal power plants was considered in a study

of all the possible disruptive failure modes of electrical equipment in

nuclear power plant installations. The only restriction was that the

study was limited to power equipment of 4100 V ac or higher, which eliminated instrumentation and control circuitry unless they were directly involved in the events.

The three most likely methods of electrical failure in power circuitry and equipment that will contribute to additional or continuing damage are fire, explosion, and excessive electrical stress. Much has been

done to eliminate these elements by close attention to design, procurement, installation, and operating conditions, and by application of standards from the National Fire Protection Association, the Institute of

Electrical and Electronic Engineers, and the American National Standards

Institute. The application of these standards for nuclear power plant

design is illustrated in the Nuclear Regulatory Commission (NRC) Standard

Safety Analysis Report GAISSAR. 1

This report considered the electrical faults of transformers, switchgear (circuit breakers), lightning (surge) arrestors, high-voltage cabling

and buswork, control boards, and other electrical equipment which, through

failure, can be the initiating event that may expand the original fault to

nearby or associated equipment. Data on each generic type of equipment

were analyzed to determine:

1. failure experience.

2. impact on surrounding and associated equipment,

3. other consequences of failure,

4. preventive measures, and

5. cost-benefit comments.

Transformers, inherently one of the most expensive (and long delivery)

items, also contain large quantities of insulating fluids (oil), some of

which contain carcinogenic polychlorinated biphenyl (PCB). Thus, a transformer failure may affect the environment as well as interrupt the electrical circuitry.

The larger switchgear units can fall not only obviously but also by

acting spuriously or by simply not functioning at all (either opened or

closed) upon command. Because the circuit breaker is originally intended

to initiate or to clear a circuit, any functional error can endanger the

connected equipment and its intended operation. The failure of lightning

arrestors almost always involves other units of equipment because lightning arrestors specifically function to shunt induced surge currents and

to limit voltage spikes. Many failures of connected equipment can be

traced to complete or partial failure of lightning arrestors.
x

Power cabling and connectors have improved greatly in recent decades,

but both are still subject to heat and mechanical damage and have definite

expected lifetimes. The failure of a cable, cleared by its protective

circuit, usually does not involve more than the individual cable and its

connected circuits; but if the failed cable does involve other cables by

its heating or mechanical interaction, the consequences may be extended to

additional areas.

The 4100-V or higher control board failures almost always involve the

cables, buswork, or circuit breakers that are installed in them, except

when some external condition, such as sprinkler activation or mechanical

damage, is the initiating event.

Of the electrical failures reviewed, examples of illustrations of

each equipment failure are examined and referenced. In this study, it was

found that man-machine interface often contributes to, rather than mitigates, the cascading effect of electrical equipment failures. Therefore,

two of the report's recommendations concerning the exchange of information

are (1) the formation of periodic conference-workshops and (2) the establishment of a data exchange information network. Also, NRC should continue to sponsor research and development activities in the areas of insulation combustibility and aging characteristics and thus use in ultra-highvoltage equipment, as well as to contribute expertise to the various standard and code writing organizations.

Reference

1. Gilbert Commonwealth Companies, GAISSARj Vol. 4 - Standard Safety

Analysis Report. Docket STN 50-595 (July 31, 1978).
POTENTIALLY DAMAGING FAILURE MODES OF HIGH- AND

KEDIUM-VOLTAGE ELECTRICAL EQUIPMENT

Harry C. Hoy

ABSTRACT

The electrical equipment failures of both nuclear and

nonnuclear public utilities were reviewed. Those failures

that could pose an additional problem to surrounding and connected equipment were defined. The literature was searched;

utilities, repair shops, and large electrical equipment users

were contacted f or failure information. -The data were reviewed in detail, and failure modes were determined. Sample

cascade failures are discussed. The failure rate of electrical equipment in utilities is historically quite low. Nuclear

plants record too few failures to be statistically valid, but

failures that have been recorded show that good design usually

restricts the failure to a single piece of equipment.*

1.* INTRODUCTION

The purpose of this study is to search out failures in nuclear and

conventional power plants to determine if the failure modes of such

equipment pose an unrecognized threat to surrounding equipment typical

of existing nuclear plant designs, and with this information to both

(1) evaluate the adequacy of design, installation, and operation of such

equipment as is typically installed in nuclear power stations, and

(2) recommend possible design, procedural, or operational improvements.

As defined in the Nuclear Regulatory Commission (NRC) statement of work,

the specific objectives of this study are to

1. obtain data on physically damaging or disrupting failures of high- and

medium-voltage electrical equipment in nuclear and conventional power

plants, electrical distribution systems, and other applications;

2. evaluate the adequacy of design, installation, and operation of such

equipment as typically installed in nuclear power stations in light of

real and potential failure modes, including fire and in-plant environmental hazards associated with insulating oils;

3. recommend possible design, procedural, or operational improvements

that would mitigate or limit the consequences of failures that could

affect or endanger the safe operation of nuclear power stations.

*An exception to this, of course, was the December 5, 1981, North

Anna Unit 1 failure where the initial fault in one of the main transf ormers resulted in damage to the generator, the generator bus, and associated equipment.
2

Nuclear power plants not only produce electric power for the utility

grid but also use a great deal of power within the plant. Therefore, any

electrical equipment failures, even nonsafety-related items, are of major

concern. It is extremely important to understand the failure possibility

and to apply this knowledge to eliminate or mitigate the consequences on

other nearby equipment or localized environmental conditions. This study

was limited to (1) 4100-V ac and above electrical power equipment such as

transformers, circuit breakers (switchgear), lightning arrestors, cables,

bus and connectors, and control boards, and (2) other associated power

generation equipment such as potential and current transformers, grounding

transformers and surge-limiting reactors, and the necessary auxiliaries

for this equipment. Toward this end, the literature over the last 5 years

was extensively searched, but the limited failure experience in this period of time has led to the inclusion of some older data.

So that the information studied would be as complete as possible,

the literature of the public utilities, both nuclear and nonnuclear, was

reviewed; thermal power plant operators and users of similar large electrical equipment were contacted to determine their reliability and/or

failure experience. Where possible, the documented information on equipment failure experiences was obtained. The applicable standards and code

documents, such as National Fire Protection Association (NFPA), American

National Standards Institute (ANSI), National Electrical Manufacturers

Association (NEMA), Institute of Electrical and Electronic Engineers

(IEEE), Nuclear Regulatory Guides (NURBG), and where available, state

and local building requirements, were studied to determine their impact

on the design, installation, and operation of electrical equipment.

The files of the Nuclear Safety Information Center (NSIC). a part of

the Nuclear Operations Analysis Center (NOAC), include listings of all

Licensee Event Reports (LERs). These LERs were searched by computer using

search strategy developed by the staff of NOAC.

The search was extended to use the same basic strategy as the Department of Energy (DOE) Technical Information Center (TIC) Energy Data Base.

Other computerized data bases on RECON were checked to obtain listings of

electrical equipment failures, not only in the nuclear power generation

industry, but in the overall electrical power utilities.

A series of contacts was made with the major domestic equipment manufacturers, such as General Electric Company and Westinghouse Electric

Corporation, and with IEEE, NEMA, ANSI, NFPA, the Edison Electric Institute (EEl), the Electric Power Research Institute (EPRI), the NUREG and

DOE standards, guides and reports, and the National Electric Reliability

Council.

To further define the electrical equipment uses and experiences, the

Tennessee Valley Authority's (TVA's) Design and Operations Divisions were

contacted. Design, testing, and operational experience were reviewed.

Documents made available included TVA engineering publications and some

specific failure reports (Appendix D).

Eight of the power generation facilities were visited. The stations

selected were chosen not only for their availability but also to represent

plants still under construction for observing installation details. Operating thermal plants (both nuclear and fossil) were selected to give as

much depth and variety of failure and maintenance records as possible.
3

The plants chosen were hydroelectric, fossil, and nuclear. The hydroelectric plants were older, representing state-of-the-art equipment and

to some extent operating techniques of the public utilities in the 1930s.

The two fossil plants span the years from 1940 to the late 1970s and demonstrate the increase in equipment size and capability and also increased

automation, not only in accessory equipment but in central and operational ability. Reflected also are the increased environmental and ecological impact abatement considerations.

Of the other nuclear power plants selected, Palo Verde was chosen

because there is a generation facility just coming on line, one under

construction, and one just starting construction. Diablo Canyon, on the

other hand, represents perhaps the latest implemented engineering and

design concepts as installed and undergoing final review for licensing.

As such, it should embody all of the latest regulatory and/or engineering

considerations.

Early in this study, definition of the electrical equipment failure

modes that can have a cascading effect was necessary. These failure modes

fall into two general classifications: (1) those where the subsequent

events occur directly and within essentially the same time frame as the

initiating event and (2) those where subsequent events, often subtle in

connection, occur in a delayed time frame because of the initial event's

excessive stress. These events most often appear as early failures of

exposed or connected equipment. Each classification has a further characterization because of the rapid development of events, and all preventive measures must be decided on and be in place before the initiating

event takes place. In the second classification, there is usually time,

however short, to eliminate or at least mitigate further damages. Each

of the two classifications can also be further categorized by the specifics of fire and its effects, explosions, missiles, physical involvement,

and by long-term effects such as environmental impacts from toxic and

ecological releases.

All information and data obtained were considered in the context of

a basic nuclear power plant schematic. While specific installations and

equipment may vary somewhat, the same basic components will usually be

found in facilities of similar eras.

Examples of events

An illustration of the first event classification would be one where

the electrical circuit breaker's catastrophic failure involved adjacent

equipment.'

An illustration of the second event classification would be the

failure of a main-power transformer where the fault is a flashover from

the high-voltage (BV) to the low-voltage winding.0, 3 Here the transformer may well be the only obvious item that failed, but all the equipment connected on the low-voltage side had its insulation overstressed

and can reasonably be expected to develop early problems.

Of course, there are combinations of these two broad classifications, such as a fire involving an BV cable that has a polyvinyl chloride

(PVC) insulation. Upon burning, this insulation gives off vapors4 that

will corrode bare metallic surfaces such as contacts, springs, and mounting fixtures. The total effect may not be immediate and allows some time
4

for preventive measures, but if the response is not quickly undertaken,

the damage caused will require replacement of affected items.

When one keeps in mind that all utilities wish to have the minimum

unscheduled outages that usually are associated with equipment failures,

it is understandable that there are few cascading types of events documented.
5

2. SYSTEM DESCRIPTION

The electrical components studied were part of the generic nuclear

plant electrical schematic (Fig. 1). This system is the source of power

for plant auxiliaries during startup, normal operation, and shutdown. It

is also the source of power for Class 1E electric loads,* which include

the reactor protection system and the engineered safety feature loads under normal and emergency loads. The switchyard is the station's connection with the utilities grid for startup power and distribution of the

plant's generated power. When the station is on line and supplying power

to the transmission network, the internal loads are supplied directly from

the generator unit through auxiliary transformers. Station loads are supplied during startup or shutdown through startup and service transformers

that receive power from the transmission network.

Power is distributed from the transformers through BV breakers, HV

cable, and buswork. Protective relay systems are designed and installed

to monitor the electrical generation, distribution, and transmission systems; if they incorrectly sense conditions or initiate spurious control

functions, they can escalate system problems. The protective relay system is responsible for the starting of emergency systems, including the

onsite diesel generators. Physical separation and electrical independence are designed into the redundant load groups for safety and reliability.

The equipment considered in this report is 4100 V ac or higher, and

its directly associated auxiliaries are shown by the unshaded portion of

Fig. 1. The energy available and the rapidity with which it is discharged

are always of concern and must be as much a part of the engineering and

design factors as any other consideration.

The circuit breakers (switchgear), transformers, and lightning arrestors are typically in rather massive metallic containers filled with electrical insulating fluid. The ]V electrical connections are made through

large corrugated ceramic oil-filled bushings. These electrical power components are normally located in segregated areas with dedicated fire and

environment controls. Indoor areas have the building service transformers and distribution switchgear. Outdoors in the utilities' transmission

switchyards is the larger main power network equipment. The equipment

locations are determined by engineering and connection requirements: the

unwanted physical interactions (e.g., fire and explosion) are limited by

separating walls and/or barricades or spatial distribution.

The cable and HV buswork have their own isolation maintained as much

as possible by conduit and separated cable trays. In spite of the cables' passive operation, some of the major problems in nuclear power

plant operational failures have occurred in the interconnecting cables.6

Much has been done in equipment ratings, design, and installation techniques; but the often congested cable-spreading rooms will remain a potential problem area for at least the lifetime of present generation

power plants.'

*Class 1E is given to equipment and systems that are essential to

reactor shutdown, containment isolation, core cooling, and heat removal.

The equipment satisfies the criteria set forth in Ref. S.
ORNL-OWG 82-63"1 ETD I. V. TRANSMISSION

LINES "• • --- i -I

I J2.

I , ? r-~ TYPICAL

SWITCHYARD I

5i..-SWITCHYARD

-4.4-TRANSPORi

'TART ..

TO CLASS IE SWITCIIGEAR

N. 0.

GENERAnTERl5 9 EwzNER,

TRANEPC

BUS

TRANSFORMER I

l

TRANSFORMER 4

tWWSTART-UP

CLASS I1 SWITCIIOIAR

N. ..

"1" IIWIT[. SWITCHGEAR 2

REACTOR COOLANT PUMPS

MCAC•O I C I

LT q PUMPSB

I REACTOR COOLANT PUMPS

rY:AL

LOAD

SWITCI°EAR 20 REACTOR COOLANT PUMPS - .4 L

TYPICAL

LOAD FROM

CLASS IS

A.k

I Lý Lid y e6 41 6 CABLES

TYPICAL

LOAD

4 4 4.

9 4 4-

.9.. FROM

CLASS 10

SWITCHOEAR I

......... ~~i~i ............ ... i• ,ii,•i,•,,ii,,li,•iiiliiii~•iii, ,,,,,,,,.. Niii•l .................... .... .. ~ ii'ii,•i']'ii ii:ii~~:i:ii:i::: ,,••,,,,,

R R 4

:'* ... ..... xx- .: .: , , , " ', - :..: *:...:::...

x- .X. ... .... ...... A .. .... . . .... .. i___ -. 0 ........ . ......

. . . . . . . . . . . . . . . .. . . .. . . .. . . . .. . . . .. . . . .. . .. . ..... .... .. . . . . .. . . . . . .. . . .... . . . . . ....... . . . . . . .......

PIF. 1. S•ho Atio of a nmoise: power plant gsawric uodtr- &ad kti-voltag. elotrical •itcuitqr.
7

3. DATA COLLECTION

The limited number of documented electrical failures of any consequence, even end-of-life failures, mandated that data collection for this

report include not only searches of the published data files but that contacts with engineering and operations personnel in electrical utilities be

used to augment the historic information. Final Safety Analysis Reports

(FSARs) of nuclear plants were studied to (1) determine the potential

equipment faults to search for and (2) assess the impact of standards,

guides, and codes.

3.1 Literature Searches

The computerized data bank of NSIC, which has the NRC-required LERs

and reported failures, was searched using strategy developed by the NSIC

staff. The files were searched for failures, LERs, and any reports that

were listed as containing information on electrical equipment failures.

The results were set up in a temporary file that was then used as a source

file against which specific units of equipment were checked. The results

of these checks were further cataloged as to year and reactor. Of the

49,000 documents identified in the original search, the numbers rapidly

reduced to

Transformer failures 196

Circuit breaker failures 307

Lightning arrestor failures 53

Control room/panel failures 525

1081

These were individually reviewed in an attempt to determine if coupled

events or trends could be determined. However, because events as cataloged and indexed by NSIC contain LERs and because reports in different

formats contain varying amounts of data, no specific conclusions could be

developed. It was then decided to review the general electrical equipment failures in the systems (and not limit the search to LERs), thus

yielding 1989 identifiable documents. Again, no failure pattern developed. The very limited electrical power equipment failure data very

clearly indicate the low failure probability and great reliability of

equipment of nuclear-age manufacture.$-' 1

3.2 Personal Contacts

By phone and visit, the manufacturers (General Electric and Westinghouse), technical societies (IEEE, NEMA, EEl, and EPRI), and geographically nearby public electrical utilities (TVA and North Carolina's Duke

Power Company) were contacted and requested to furnish failure information. Little-definitive failure description was obtained.
8

The documentation thus obtained was sparse and variable in quality

and completeness. It did, however, provide a basis for determination of

the number and types of failures that could or did subsequently involve

other equipment. The information was carefully scrutinized to select

those events that, because of the very character of the occurrence, were

major initiators of a chain of happenings that greatly extended the equipment involvement and the potential for compromising the operational integrity of the plant's safety systems.

The equipment manufacturers, users, and architectural and engineering

firms were contacted, from which came vast amounts of information on design and installation criteria but very little definitive information on

failures. This is understandable because when equipment is sold and installed, its maintenance and repair is then directly controlled by the

user. Often the larger utilities will do their own servicing and repair

with only the major overhaul or upgrading being contracted to other parties. Also, many large, cumbersome units such as transformers cannot

easily be transported any distance for repair.

The exchange of spare units between facilities of the same utility,

as well as the switching of equipment between units on the same site, make

it almost impossible to obtain reliable data on equipment failures. The

validity of the data is further compounded by the different interpretations of failure. Some operators define failure as any reason for which

the equipment is removed from service, even for indicated maintenance;

others identify failure only when the unit malfunctions in an obvious

way. There is presently an IEEE committee collecting electrical equipment failure data, but as yet it has published no report.

3.3 Applicable Codes and Standards

The NEMA, IEEE, NFPA, and ANSI standards as modified by the NRC regulatory guides and local building requirements all have an impact on the

specifications, installation, and operation of electrical equipment. In

general, the equipment needed and its applicable codes and standards are

shown in Ref. 11 and in NRC regulations, but the detailed specifications

must be supplied by the design architect-engineers.

3.4 Plant Visits

As visits to the power plants (Table 1) were limited to roughly 1 d

at each site, no in-depth detailed engineering inspections were made.

Instead, only those impressions of a conducted tour and brief discussion

follow. The obvious things that stand out are the cleanliness of the hydroelectric plants in spite of their approximately four decades of online operation, the inherent dust and noise of the fossil-fuel thermoplants, and the size and complexity of all aspects of the nuclear power

stations.

The Diablo Canyon Station, located in one of the most picturesque

sites imaginable, seems smaller because the switchyard is somewhat remote

and the large air-cooling towers are missing. The memorable features

were the unusual seismic considerations in all aspects of design and

cleanliness similar to that of hydroelectric plants.
9

Palo Verde, of those plants visited, gave the most lasting impression

of having somewhat different approaches to engineering problems. For

instance, the cable-spreading rooms are both above and below the control

room. This, plus the inherent large rooms allowed, drastically reduces

the congestion and complication of the multitude of cables that must be

routed through these areas. Servicing and maintenance problems should be

greatly reduced. Any repair that may be required should be easily expedited. Also, in the transmission line connections between the switchyard and main buildings, there were constant tension devices installed to

compensate for thermal expansion and contraction strains. Generally, the

impression of good engineering plus use of available space prevails.

The TVA sister plants, Watts Bar (which is still under construction)

and Sequoyah [which has only recently (1982) gone to full-power operations], offered the opportunity to observe equipment in production and to

discuss operation and maintenance with Sequoyah personnel involved and

then to compare almost directly with Watts Bar, which is in the final

stages of construction. The limitations of equipment access posed by the

operations at Sequoyah were not, of course, evident at Watts Bar. WA

arranged contacts with members of their design, operating, and nuclear

power divisions. This, with several visits to a variety of their facilities, was most helpful. It was comparatively easy to follow from concept

through design, specification, purchase, installation, and operation of

the electrical equipment in these plants and to see the equipment and

engineering philosophy changes that have occurred over the four decades

from the early hydroelectric and fossil units to the present nuclear generation plants. Not only is the present equipment much larger and more

sophisticated, but the degree of complexity and automation has greatly

increased. The labor-intensive, experienced, skilled, hands-on operation

of the older plants has been largely replaced with a programmed automatic

response - a response where the operator, though highly trained, must

react from an understanding of a display and not from direct association

with equipment.

Table 1. Electrical power plants visited

Name Type Built Location

Norris Dam Hydro 1935 Norris, Tennessee

Watts Bar Hydro 1943 Watts Bar, Tennessee

Watts Bar Steam Fossil 1944 Watts Bar, Tennessee

Bull Run Steam Fossil 1971 Powell, Tennessee

Watts Bar Nuclear a Spring City, Tennessee

Bellefonte Nuclear a Scottsboro, Alabama

Sequoyah Nuclear 1980 Chattanooga, Tennessee

Palo Verde Nuclear 1983 Palo Verde, Arizona

Diablo Canyon Nuclear 1983 Diablo Canyon, California

Virgil Summer Nuclear 1982 Jenkinsville, South Carolina

aNot in operation as yet.
10

The Virgil Summer plant was unique in the plants visited in that it

was complete and actually producing power (10%) for the grid. It is a

single unit with an adjacent pumped-storage hydroelectric peaking plant.

Construction activity was much less evident, with access to operating

areas more restricted.

Discussions with design, operating, and maintenance personnel indicated that while each utility has its own testing and maintenance schedule, most if not all use Doble equipment and procedures for routine and

troubleshooting tests.

3.5 Doble Clients Conference Proceedings

The Doble clients conferences are sponsored each year by the Doble

Instrument Company. The proceedings 1 2 contain papers presented at the

conference and the results of surveys made during the previous year. Some

of the surveys list failures of electrical power equipment. The papers

presented often detail how equipment failed and what preventive measures

and/or tests are used to preclude additional failures. This conference

is perhaps one of the best information exchanges presently available. It

offers a forum where early and unusual problems are discussed and solutions are outlined.

The annual conference proceedings were reviewed from 1976 to date.

The information and references provided insight into the equipment failure

mechanisms that offer cascading failure potential in power generation and

distribution facilities.
11

4. EVENT DESCRIPTION

Within the time frame studied (from 1977 through June 1982), there

were only a few relevant events that were described accurately and completely in the available documents. Of the other events reviewed, many

had the very real possibility of being an initiating event (in a series

that could result in a major outage or the loss of one safety train); but

because of correct personnel response and engineered safeguards, none

did.

In many instances, the lack of correct or incomplete human responses

clearly played a large part in the final total event, and it is of major

concern that some large fraction (20 to 50%)19 of all failures are attributed directly to involved personnel. A discussion of the impact of fires

associated with electrical equipment is included because of the potential

consequences of such events.

4.1 North Anna Transformer Failures

The output transformer failures that occurred in 1980 and 1981 are

an excellent example of human contribution to the failure sequence. This

series of four failures of the main output transformers (920 MW) occurred

over the period from November 29, 1980, through July 25, 1981. The failures were characterized by two basic failure mechanisms: (1) the failure of the first and fourth transformers were windings to ground (core)

faults and (2) the other transformer failures were RV bushing to ground

failures. All failures except one also had high- to low-voltage winding

arcing. The transformers were installed in a three-phase circuit with a

separate transformer for each phase. In looking at the individual history of the tranformers, it developed that "all transformers had (1) been

transhipped several times before being placed in service at North Anna,

(2) had been in previous operation where one of the other transformers

in the bank had failed prior to their own failure, (3) the transformers

high voltage bushings had been handled more than usual, and (4) transformers 1, 2, and 4 had been subjected to several documented over-voltage

transients. -I4

Not only were the transformers themselves involved, but the July 3,

1981, incident also had a turbine and reactor trip associated with the

event. The incident fire sprayed oil over the transformer case and the

side of the turbine building. A voltage transient apparently was great

enough to create an erroneous high steam flow signal, which gave a safety

injection actuation. The situation was cleared within a few hours. There

was no effect on the health and safety of the public.

The detailed description of this event clearly indicates the possibility of a domino cascading series of events that could (but did not)

have had far reaching effects. From the associated LERs and the trip

report (and, of course, using hindsight), the indications are that had

there been better exchange of information between the station and district electricians and the plant engineering and operations personnel and

more complete maintenance procedures, the initial and subsequent transformer failures might have been prevented.
12

The North Anna Unit 1 "C" main transformer failure of November 16,

1982, and especially the "B" main failure of December 6. 1982, illustrate

the extent of damage, both mechanical and electrical, that can result

from a major transformer fault. In this instance the damage extended to

the bus and generator itself and the transformer water diluge system.*$

4.2 Y-12 Switchnear Failure

In September 1971, at DOE's Y-12 Plant in Oak Ridge, Tennessee, dual

electrical short circuits occurred in 13.8-kV switchgear. These failures

involved two similar units connected to the same buswork. Both were explosive in nature and resulted in multiple injuries. The initial fault

occurred when the first breaker was disengaged from its feed connection,

apparently after the breaker had failed to correctly clear the residual

load current. At this time, three people were injured, and oil, fumes,

and copper droplets were dispersed in the switchgear cabinet. Sometime

later, a larger circuit breaker (bus tie) faulted while being disengaged.

Nine employees were injured at this time. Total damage was estimated at

$20,000 (1971 dollars). Electrical outage time was -2.5 h.

From this report, it can be concluded that the initial violent failure must have been preceded by the breaker's failure to open correctly on

signal, and the indicating lights, one of which was burned out, did not

indicate correct breaker condition. However, it is almost second nature

to one experienced in operation of these breakers to sense the "thump"

when the breaker opens or closes and to check for either a closed or open

indicating light. One of the two must be on. Apparently, the breaker did

not open so that when it was "racked out" the circuit was actually interrupted by the external make-up contacts. These are passive contacts not

intended for either making or breaking load, and as a result, there was

arcing and an explosive-type electrical fault. To clear the debris, the

separating bus-tie circuit breaker was opened. This larger breaker between two major buses had no voltage across it until it was opened, but

apparently it had received some damage during the first event, and it too

failed when actuated. Had not habit and routine overridden precautions

that should have been taken upon lack of indicating light, the initial

breaker trouble could have been reduced or eliminated.

4.3 Transformer Fire at ENICO Substation

A transformer fire at the ENIC0 Substation's injured three persons

and did an estimated $166,000 (1982 dollars) damage. The fire and explosion occurred during the phase evaluation testing of two 2400-V feeder

transformers with the intent of placing the two feeders in parallel. One

of the two transformers had been removed from this service; during the

time it was removed, its phase connections had been changed, making it

impossible to be reinstalled in its original configuration. (From Beeman,

"Industrial Power System Handbook," in the section pertaining to Wye-Delta

*Notification of unusual occurrence, December 6, 1982, and following

status reports.
13

three-phase transformers, there is an inherent 300 phase shift. 1 ') When

the power demands on the substation exceeded what could be supplied by

the remaining transformer, plans were made to reinstall the second transformer. When attempts were made to match phases for paralleling, diagnostic tests indicated a problem. To obtain additional measurements, a

high-voltage connection unit (BVCU) was to be used. The BVCU can be installed in place of a circuit breaker with comparable dimensions and is

capable of being "racked in" to make line and load connections in a manner similar to a circuit breaker. During the test, an attempt was made

to obtain identical meters, but when none were found, it was decided to

install multimegohm resistors between respective phases. Voltage readings could then be taken across the resistors. The devices selected

looked like resistors but actually had the electrical characteristic of a

surge suppressor (i.e., the limiting or clamping of a dc voltage) and the

further characteristic of exponential current conduction with linear increase of applied voltage. When the HVCU was racked in place, these devices quickly overheated and exploded. The explosion destroyed the devices, the HVCU, and the distribution equipment in the immediate vicinity. Power to the EV loop was interrupted for some 27 h. Incomplete

engineering, lack of specific responsibilities and authority, incorrect

equipment and material use, and failure to obtain EV safety permits were

all human contributions to the event.

4.4 Brighton Area Breaker Failure

The Brighton incident 1 7 points out the possibilities of expanding the

original event into one of major consequences. The Brighton incident

started with a cable fault that was not interrupted by its 14-kV circuit

breaker. The arcing across the circuit breaker resulted in a bus fault.

The associated relaying not only cleared the bus fault but also opened the

circuit breakers to protect a transformer that supplied two bus sections.

The resulting surge caused an insulator failure that created another bus

fault. The second circuit breaker exploded in attempting to interrupt

power beyond its capacity. The total time involved was (17 s. During

this time, some 8 in. of the power cable conductors and 33 in. of the

lead sheath had been vaporized. The partition wall between two bus sections was severely damaged, as were two circuit breakers.

The series of events illustrates quite well the closely interconnected features of any electrical power system and the dependent interactions that can and do take place. In this instance, cables, circuit breakers, insulators, interconnecting bus, and relaying and control boards each

played its part in the event. Except for incorrect relay settings, these

events reflect equipment failures. In the case of the relay settings, it

is difficult to calibrate protective relays for rapid fault interruption

and at the same time to allow the proper level of operational variations

that will occur so the circuit will not be unnecessarily interrupted.

Good design coupled with regular complete maintenance and testing are required for greatest reliability. It is important that any change in load

be reflected in the sensing level of the overload relaying, which monitors

the total load of the circuit (i.e., a partial decrease in load can be

replaced by a fault of equal size without the monitor reacting).
14

4.5 Fires

Fires associated with electrical power equipment have an impact, not

only on the directly involved equipment, but also on other nearby facilities because of smoke, toxic fumes, and heat. The heat is of immediate

concern (as are the smoke and fumes), but the smoke and fumes may also

have long-term consequences on contacts and circuit loads and may coat

insulators, causing chemical changes in plastic insulations. Fires and

the associated heat soften plastic insulation, fracture ceramic insulators, and may, if there are containment tank ruptures, spread burning

insulating oil [often containing polychlorinated biphenyl (PC)] over

floors and into drain systems. The most destructive fires experienced by

nuclear power plants involved the vast amount of cabling installed in the

plant, for example, the Browns Ferry cable fire. This fire and others in

recent history have caused improved design and installation requirements

as well as some improvement in the fire characteristics. Recent tests by

Sandiaas-20 have been concerned with the consequences of cable fires and

the resulting smoke and fumes.

Not all plants have automatic fire-suppression systems; some depend

on alarm followed by manual response. In these situations the availability of portable extinguishment equipment and correct evaluation of the

situation is extremely important. Training of response personnel and

permanent descriptions of equipment and procedures (locally displayed)

should be a part of each plant's procedures, especially those depending

on manual suppression of fire.

4.6 General Considerations

Although not a failure mode of electrical equipment, the rapid and

correct response of emergency and maintenance personnel is a concern.

Therefore, it seems extremely prudent to use color-coded and distinctive

tags to indicate safety-related equipment, service equipment, and auxiliary equipment. Most plants do this, but there does not seem to be a

standard for either color or voltage-level designation.
15

5. EflUIPMENT FAILURE ANALYSIS

Experience has shown that most electrical equipment failures are

randomly distributed in both time and type of equipment. The documentation on these failures is frequently inaccessible and/or incomplete. Most

utilities and major industries publicly document only those events that

are required by regulation. However, some idea of the number and type of

occurrences can be obtained from the Doble Clients Annual Conference Proceedings.1 2 These proceedings often detail how equipment failed and what

preventive measures and/or tests can be used to preclude additional failur es.

Descriptions of failures of electrical equipment can be obtained not

only from the DobLe Clients Annual Conference Proceedings but from utility

and manufacturers' repair facilities, as well as from companies that specialize in rewind and repair of electrical equipment. Such facilities as

TVA's and General Electric's Chattanooga repair facilities were contacted.

However, while they can show the damage and can detail what is needed to

refurbish the component, little or no information can be obtained on how

or why the event was initiated or what other equipment was involved. The

damage to the equipment itself does graphically illustrate that the amount

of available energy can and does cause physical damage capable of contributing to associated components. The associated toxic fumes and splattering of ejected molten materials, including copper, on nearby insulation

and control equipment may well extend the damage potential. Unfortunately, this extention of damage is not often documented, nor is information available in the repair orders.

5.1 Transformers

Of the 96 transformer failures reviewed and identified in the NSIC

data base (category 17), none resulted in a major explosion or created any

type of missile that was ejected or caused further damage. Several, however, contaminated the surrounding area with fumes and insulating fluid

(oil), some of which contained PCB. The PCB, which is carcinogenic, is

not biodegradable and therefore creates a problem in containment, cleanup,

and disposal.

A more insidious fault occurs when the high-voltage winding flashes

over to the low-voltage winding. This event, even though often of short

duration, subjects everything electrically connected to the low-voltage

terminals to the potential of the incoming line high voltage. This

stresses, usually by at least a factor of 20 (and sometimes much higher),

the insulation, microchips, cabling, and connectors to the point where

decreased service life, if not immediate failure, can be expected. While

surges can be generated by switching and rapid load changes, a great number are associated directly with transformer failures, so much so that NRC

emphasizes the problems by stating:

***There is evidence to support concern that common failure

modes can exist in the nuclear plant safety systems whereby

surges of a transient nature could render redundant components
16

inoperable. . . . Such high voltage occurring even for short

durations could destroy sensitive equipment in onsite distribution buses and render onsite power supplies inoperable ...

The increasing common use of highly sensitive solid state

logic systems . . . accentuates the need for closer scrutiny

in the method used for protecting such systems from transient

overvoltage.2

5.1.1 Failure experience

Two reports of transformer failure rates for main and/or startup

transformers give 2.7 x 10-2 failures per year of operations and

7.8 x 10-2 failures per year.3 Both of these seem rather high compared

with the author's experience, but the definition of failure used includes

all reasons for the equipment to be taken out of service, including minor

maintenance.

Although failure rates are not indicated, the number and type of failures as listed in the Dobl.e CMienta Annual Conference Proceedinge are

quite informative (Table 2). Only scattered details are given on the

total damage and cost of replacement or repair, but in the number of failures listed there is good evidence to support the need for onsite replacement (spare) equipment. A well-designed and manufactured transformer,

Table 2. High-voltage power

transformer failuresa

Year Number of Documented faults and failures

failures

1980 220 29 internal faults, 6 bushing failures

1979 218 33 violent internal failures, 2 insulation failuresb

1978 183 3 ruptured tank failures, 5 insulation failuresb

1977 246 1 insulation failureb

1976 177 83 internal faults, 3 insulation failuresb

1975 212 2 insulation failuresb

aAdapted from Dobte C•ient8 Annual Conference Proceedings. 1 2 Most failures are power transformers of

13.8 kV and above.

bAdditions from American Nuclear Insurers, private

communication with author.
17

properly protected, should have its operational life limited only by the

aging characteristics of its insulation material and/or lack of adequate

maintenance.

5.1.2 Impact on surroundings

Because of the adherence to good engineering design practices as indicated in Refs. 21-23, any failure impact on even the immediate surroundings is usually small. Most HV transformers are located in the switchyard, protected by barricades and sprinkler systems and with a curbed

crushed stone fluid retention system. The transformers located indoors

usually are in their own vault with their own fire protection, containment, and drain systems. Therefore, transformer failures, even those that

result in fire and/or insulating fluid spills, have their own direct containment and control that limits the expansion of the event to the immediate area.

5.1.3 Other consecuences of failure

In addition to the modes discussed above, the failure of a singlephase transformer (one of three used in a polyphase system) will severely

unbalance the system and create circuit-unbalanced loading, requiring the

reduction of loading on additional equipment. This load reduction may

involve some redundant safety and operating systems that will necessitate

the operator's very careful realignment of the loaded circuits.

5.1.4 Preventive measures

Careful on-line monitoring of the characteristics of the major transformers, including the transformer power factor, load vs temperature factors, and any changes that occur in the insulating fluid characteristics

(such as viscosity level, dielectric strength value, gas and/or chemical

contamination), should be recorded and used as a basis for scheduling preventive maintenance.

High temperatures or temperature changes not associated with loading

conditions or ambient temperature require quick attention. The trends

indicated by the monitoring and testing often indicate potential problem

areas that require additional maintenance.

All power transformers, of course, must be protected from surges

caused by lightning strikes, switching, and harmonic circulating currents,

as well as the high temperature that could result from exposure to fire

or because of reduced cooling.

5.1.5 Cost-benefit comments

With the high initial cost of equipment growing each day, the expense of repair and maintenance, plus the loss of revenue from nonoperating equipment, it is quite clear that failure rates of the major equipment must be minimized. Regular periodic maintenance scheduled in conjunction with other outages (e.g., during reloading) is not only much
18

less costly in equipment and manpower, but allows the system load projections to become part of the calculation.

5.2 Switohmear

Unlike transformers that are a quiescent element, switchgear is an

active element that can fail by acting spuriously or by not functioning

(either to open or close) upon command. These incorrect functions can

create problems in the connected circuits that are quite different from

those that result directly from any fire, explosion, or spread of possibly toxic insulating fluids. If a breaker fails to clear upon signal or

becomes overloaded for any reason, then the circuit will be subjected to

further damage until an upstream breaker (usually larger and set for a

higher current rating) can sense and clear the overload. If, on the

other hand, a breaker fails to close, this normally means that all circuits that receive power from this feed point cannot perform their expected functions. As in the Brighton area breaker failure's (described

in Sect. 4.4), the event may well be quite violent and create additional

problems such as fire and fumes. Fortunately, most breakers are located

in enclosed segregated areas, which provide containment and fire protection capabilities, as well as in their own cabinets, which help limit any

physical damage to immediately adjacent equipment.

5.2.1 Failure experience

Although there have been numerous reports of switchgear failures

(see Appendix A), few have been violent or have involved other items of

equipment. The Brighton, Y-12 Plant, and ENICO events previously described typify the possibilities of switchgear failure where equipment

other than the switchgear unit itself becomes involved. These were exceptions; most switchgear failures like the circuit switcher failure in

the 345-kV switchyard at Millstone1 4 may severely damage or even destroy

the switchgear itself but do not physically involve nearby equipment.

Any switchgear failures do, however, create problems to and with the connected circuitry and cause unwanted shifting and/or dropping of electrical loads. A listing of circuit breaker failures is presented in

Table 3.

5.2.2 Impact on surroundinL&

Of the documented failures, some 10 to 15% result in the destruction

of the switchgear unit itself. Fortunately, however, because of the

strict standards and codesls-Se that deal with location, installation,

and protection of electrical switchgear, even violent failures seldom

result in direct physical involvement of adjacent equipment. The exceptions previously described did interact with equipment in the same area

through fire, fumes, ejected molten material and electromechanical

forces. The consequences varied from short power interruption to equipment replacement.
19

Table 3. Circuit breaker failuresa

Number of

Year breaker Type of failure

failures

1980 221 22 explosions and/or ruptures (lower

voltage vacuum breakers almost

always completely destroyed)

1979 89 20 explosions and/or ruptures

1978 62

1977 61 133 malfunctions

1976 93

1975 45 99 malfunctions

aAdapted from

Proceedinge.1 2

Dobge C•ients Annual Conference

5.2.3 Other consequences of failure

Interruption of any major electrical circuit has the possibility of

creating unbalance in the supply circuits which can cause cascading load

rejection in addition to the loss of power to the equipment supplied

directly by the circuit breaker. Spurious switchgear operation, either

opening or closing, can easily be responsible for the creation of unsafe

conditions. For instance, an unscheduled opening may disconnect a load

vital to some phase of operation, or a breaker closing could subject the

system to unneeded load surges.

5.2.4 Preventive measures

Good equipment, brought to nuclear power plant specifications and

meeting ANSI, NEMA, IEEE, and NRC regulatory guides, and proper maintenance, which must include periodic testing, are the keys to minimum operational problems. Proper relaying and control devices must also be

part of the design and installation.

5.2.5 Cost-benefit comments

NEMA and the specific recommendations by manufacturers on maintenance and service replacement indicate the number of spares required;

based on duty cycle and/or time, the testing is prescribed.
20

5.3 Lightning Arrestors

Lightning arrestors do not have a high duty cycle but must function

when called on, or damage to other elements will be excessive. Lightning

arrestors for nuclear and other utility power generation facilities make

use of three major types of surge arrestors: (1) distribution, (2) intermediate, and (3) station. Most installations in the switchyard and

transmission line protection schemes are of the station type. This type

is used because of its discharge-current capacity and its near constant

voltage-time characteristic. Any consideration of lightning arrestors

must be directly coupled to consideration of the associated grounding

system.

The purpose of lightning (surge) arrestors and proper grounding is

to limit the excessive currents and voltage spikes that occur during

lightning or switching-induced surges. Especially vulnerable equipment,

such as main and startup transformers, should be protected on both the

high- and low-voltage sides, to protect not only the insulation value of

the transformer but to keep sensitive electronic monitoring and control

equipment in the plant from being subjected to damaging voltages and currents. Very careful engineering design must maintain the matching of

protector and protected equipment at all times, and any change in one

should be carefully reviewed for the possible corresponding change needed

in the other.

The importance of proper selection of the (surge) lightning arrestor

and good grounding design cannot be overemphasized. Both arrestor selection and equipment grounding design must be based on an understanding of

the rise time, peak value, and time distribution of lightning strikes and

the local isoceramic information. Arrestors must be sized not only to

protect from overvoltage, but also to be capable of carrying the surge

current and responding to the steep wave front. As in the section on

transformers, the NRC Regulatory Guide2 lists the standards and regulations that must be followed.

5.3.1 Failure experience

Lightning arrestors technically fail any time the circuit or equipment they are designed to protect is damaged. Thus, if an arrestor functions correctly on the initial surge but cannot recover fast enough to

protect on a rapidly following second spike or if the wave front is too

steep for the arrestors adequate response, then the arrestor has failed.

Lightning (surge) arrestor failures are often characterized by physical failure of the ceramic insulator and containment, but because of the

physical location of the arrestor as dictated by IEEE, ANSI, and NRC

regulations, there is seldom any physical involvement of other equipment.

When one does fail (Table 4), there is normally no doubt from the visible

damage that the unit is no longer functional. However, in spite of the

numbers that are replaced each year, no reliable failure rates are available.
21

Table 4. Lightning arrestor failuresa

Number of Type of failure failures (% violent)

1980 123 95

1979 104 80-85

1978 90 80-85

1977 127

1976 129

aAs reported

AnnuaZ Conference

in Dobte Clziente

Proceedinga.x

5.3.2 ImPact on surroundings

The impact on the surroundings from a lightning arrestor failure is

normally not as important as the loss of its capability to protect the

circuits and elements to which it is connected.

5.3.3 Other consecuences of failure

The possibility of additional damage to the lightning arrestor's

connected circuitry is a direct function of whether the arrestor failed

shorted or open and if there are any subsequent voltage or current

surges. Therefore, the service or replacement of an arrestor must be as

expeditious as possible.

5.3.4 Preventive measures

With proper installation and periodic maintenance, lightning arrestors can be expected to serve as protective devices for periods of time

that will be site specific. Weather conditions, especially snow or ice

mist, can be expected to increase exterior current leakage and the resulting tracking, but this should be known from periodic testing before

major failure occurs. Care in cleaning, for dust in particular, is also

a must.

5.3.5 Cost-benefit comments

The number of spares available and the maintenance schedule depends

on the geographic location, the operational characteristics, and the

climatic considerations so that the judgments will be site and equipment

specific.
22

5.4 Cables and Connectors

Power cabling, as used in generation stations, is usually limited to

(13.8 kV. (Some facilities use cabling of 161 to 230 kV in the switchyards, but because of the large radius turns required by the cables' massive size, such cables are not normally located indoors or used as distribution cables).

Because these cables must be concentrated to some extent near the

distribution centers where they often run in a common cable tray, they

are vulnerable to cable tray fires. Individual cable faulting, which can

be cleared by its series breaker or fuse, typically will not involve more

than the affected cable unless that cable by its heating becomes a fire -

a fire that may spread to adjacent cables and cable trays. Once a cable

tray fire has started, not only does its extinguishment become difficult,

but damage potential can spread greatly beyond the limits of the fire.

Almost all present-day power cables use polyethylene and PVC insulation,

which when heated sufficiently by internal or external means will evolve

flammable gas, then char and burn. 1 '

Even when protected by coatings and/or located in covered trays,

cabling rapidly becomes unusable for electrical circuitry when subjected

to fire or extreme heat. There is even some evidence's that, depending

on the coating and the method of its application, long-lasting deepseated fire duration is increased by coatings, which will increase the

difficulty of quick and complete extinguishment of such a cable tray fire

once it is started. For this reason, extra care and attention must be

given to prevention and early detection of overheating and possible

ignition in any area where cables contribute significantly to the fire

loading.

Cables are sometimes used in switchyards (HV) as a means of disconnecting or insulating circuits and are therefore not expected to be

physically removed very often. However, when required, their removal

becomes somewhat of a problem because of their size and location. The

voltage clearance and current-carrying capacity mean long length, and the

current rating is reflected in their cross section. Both size and weight

make manual handling difficult; during bad weather and emergency conditions it could become almost impossible.

5.4.1 Failure experience

The well-known cable tray fire at TVA's Browns Ferry Plant's did not

start, of course, as a cable fault, but the fire ultimately involved some

2000 cables in its 7-h period of burning. Cable insulation, coatings,

and installations have improved since and largely because of this event.

Many failures of the older type of power cabless3 were caused by cable

ages of 30 to 40 years, subjecting them to excessive moisture and mechanical strain. Of these factors, only aging should be a consideration in the

nuclear power industry. The failures listed in Table 5 are largely of

major distribution networks and not in-plant cables as such, but the basic

cable size and capacity are similar.
23

Table 5. High-voltage powe& cable

and connector failures

Number of Type of failure

Year failures Splice Pothead Insulation

1980 1700

1979 4190 1158 326 2706

1978 5997 2269 563 3165

1977 2922 806 316 1800

1976 5382 936 370 4076

aAdapted from Dobte CMiente AnnuaZ Conference Proceedings .1

5.4.2 Impact on surroundings

Cables, when they do fail, quite often will involve more than the

initial cable through fire, mechanical movement under electromagnetic

forces, and ejection of molten copper when arcing. In addition, because

cables are generally grouped together some place in their run, more than

one cable and operational piece of equipment can be involved.

If a fire develops, the toxic fumes from the combustor can coat insulating surfaces and contacts and create unwanted deposits on microprocessors and control equipment.

5.4.3 Other consecuences of failure

The mechanical movement of cables under heavy short-circuit currents

can create stress on terminals and hangers. The electrical surges can

introduce circulating currents in the ground system of sensitive electronic equipment, which will cause spurious signals.

5.4.4 Preventive measures

Careful routing and proper cable restraint can help reduce the

stress that may be induced by thermal expansion and contraction of cables

having long runs, especially those with vertical sections. Periodic HV

testing ("hi-potting") may not reduce the failure rate, but it will allow

the repair or replacement of incipient failures during test downtime, not

during normal operation.

5.4.5 Cost-benefit comments

Because of the relatively low cost of cables compared with forced

outage for replacement, and particularly because a cable failing in operation may cause additional damage, it is important to note any change
24

in operational and testing data and to repair or replace the cable before

a major event can occur.

5.5 Control Board

In the available literature, all of the control board failures

originated as faults in cable terminations or circuit breaker disruptive

failures, or they were caused by some external fault such as fumes from

fires, mechanical damage, or water damage from sprinkler activation. It

is suspected that the contribution to unwanted outages made by control

boards, as such, is small and is the direct result of the initiating

events caused by installed electrical or mechanical equipment.

5.5.1 Failure experience

No instances of massive control board failures were found in the

literature other than those that originated in circuit breakers. The

only major contribution a control board is likely to make would be with

a seismic event as the driving force, and all safety-related boards have

passed simulated testing.

5.5.2 Impact on surroundings

In the event of a failure induced by a major seismic event, the additional contribution that a control board could make would be small except

for the disruption of control and power circuits.

5.5.3 Other consequences of failure

Because the control boards are, in a sense, the nerve centers of

the electrical system, their failure could create inability to react to

needs; however, the chance of control board failure is extremely remote.

5.5.4. Preventive measures

Use of qualified equipment and good engineering based on IEEE, ANSI,

NEMA, and NRC guidelines and regular preventive maintenance will continue

to reduce the already low probability of control board failure.

5.5.5 Cost-benefit comments

Good design and accessibility will enable proper maintenance and

testing to keep equipment operable.
25

5.6 Other Equipment

Within the 4.1-kV and upward range, the only other equipment considered was the testing devices. Each power system should have a completely equipped, highly trained crew that can perform the routine testing and maintenance. The crews must have access to power factor meters,

phase meters, scopes, EV test probes, acoustical meters, and insulating

oil test and filtering equipment. Testing devices must be carefully selected to have adequate intrinsic safety and proper range for the circuit

and equipment with which they will be used. Proper maintenance and

periodic calibration are required for safety and meaningful results.
26

6. MAXIMUM POTENTIAL COMPONENT FAILURE MODES

The maximum potential electrical component failure modes that can contribute physically - as opposed to electrically - to subsequent equipment

failures are summarized herein based on the insights provided in the preceding chapters of this report. The physical failure modes considered are

missile generation, ejected liquid coolant and/or insulation material,

fume generation by fire, and mechanical movement. Not considered herein

were electromagnetic and directly coupled electrical circuitry effects.

The electrical equipment considered includes (1) transformers, (2) circuit

breakers and/or switchgear, (3) lightning arrestors, (4) cables and connectors, and (5) control boards.

It has been shown earlier that internal faulting of large electrical

equipment can generate energetic missiles, L," spill carcinogenic (PCB)

insulating fluid. 1 4 generate volumes of toxic fumes,4,1S initiate fire

protection systems, and mechanically stress associated equipment. These

failure modes, given the right combination of time and location, can become a low-probability high-consequence event that may affect other safety

equipment. This is of particular concern if a parallel safety train is

compromised. Such consequences are considered in the next chapter. In

this chapter each of the major equipment types identified above was considered as having failed in a worst-case manner.

6.1 Transformers

The transformers considered varied from large three-phase main transformers, single-phase main transformers, and startup and auxiliary transformers to distribution and service transformers. Current transformers

and potential transformers were also considered but because of their

physical location and limited energy capacity were not expected to have

any contribution to subsequent events. The large main transformers are

generally located in or adjacent to the plant switchyard or just outside

the turbine-generator building and are directly connected to the main bus

work (see Fig. 1). The startup and unit auxiliary transformers are normally also located outside the building but may on occasion be installed

indoors.

6.1.1 Eneraetic missiles

High internal pressure from intermittant internal arcing, or a flashover, which expends a large quantity of energy in an extremely short time,

can rupture the container and launch metallic and/or ceramic missiles.

The missiles may be of several pounds and can be thrown for some distance.

While documents do not include the specifics, eyewitnesses describe the

size as a maximum of 10 lb thrown for some 30 to 40 yards. Smaller missiles may have higher velocity and travel further with a more direct

path. (See additional bibliographical references in Appendix C.)
27

6.1.2 Insulating fluid spills

The same internal pressure as generated from intermittant arcing may

mechanically rupture the container so that the insulating fluid (the older

variety quite often contains PCB) can spill into the curbed containment

space or be projected in a stream or jet for 10 to 20 ft. Usually the

fluid is contained within the curbed space and there is no fire so that

only a cleanup and disposal problem remains. However, if the fluid

catches fire, as could occur if there were arcing, the problem may well

escalate in several ways (see Sect. 6.1.4).

6.1.3 Toxic fumes

The burning of insulation and insulating fluids, especially indoors,

cannot only create problems in the immediate area but also in other areas

because the fumes and combustion products, some of which contain released

chlorine, when picked up by the ventilation system may coat insulators

and sensitive monitoring and control circuits. Accelerated failure of

such affected components may result if they are not properly cleaned. The

fumes themselves may make some areas uninhabitable and thus reduce the

manual control capability of some areas.s,Is,l1-20,Sl

6.1.4 Fire protection systems

The fire protection system normally will have a detection system

(smoke or heat rise) and a suppression system. The suppression system may

be either a direct-acting, a supervisory automatic, or a manual system.

The supervisory automatic and direct-acting systems usually have water or

carbon dioxide (CO2) as the suppression material. Halon is quite often

manually activated. When sprinkler deluge systems using water are activated, the resultant diluge may overflow the curbed areas and carry the

insulating fluid and/or fire into drains and adjacent areas where other

equipment can become involved.

6.1.5 Mechanical stress

Rupture of the transformer container may jar the connected or adjacent equipment via interconnected lead whip and by physically inducing a

mechanical stress. Either of these may cause ceramic insulation to break

or pull cables and connectors apart.

6.2 Circuit Breakers and/or Switchaear

Circuit breakers may fail by not responding to correct signals, but

these faults, although potentially damaging, are electrical in nature and

were not considered. The maximum potential failure modes of circuit

breakers are discussed in Sect. 7.2.
28

6.2.1 Eneraetic missiles

Because circuit breakers are designed to control the electrical power

flow (open or close circuit) and are expected to dissipate large amounts

of energy for short periods of time, they are sturdily constructed and

mounted. However, should a fault occur that exceeds design limits of the

circuit breakers, the resulting failure (similar to an exposion) may eject

pieces of the ceramic insulators, bolts, and/or cover plates from the main

body of the circuit breaker. These missiles are most likely contained

within the breaker cabinet or vault of indoor breakers. When the electromechanical forces exceed the designed capability of the breakers to the

extent that matter is ejected from the breaker, the material is usually

insulation, insulation fluid, or molten metallic spray. The damaged area

extends only a few feet to the nearest cold surface usually, but there is

a possibility that the insulating fluid or molten insulation may leak or

drip through cracks or gaps into other areas. The large switchyard and

transmission line breakers that may generate larger missiles have wide

physical spacing in limited-access areas and seldom initiate other faulting.

6.2.2 Insulating fluid spills

Large-capacity high-speed circuit breakers are going more and more to

gas (SF 6 ) insulation, but many of the currently installed units contain

mineral oil or Askeral. Both of these fluids are highly flammable under

the right temperature and ignition-source conditions and will burn quite

vigorously once ignited. In addition, Askeral (and similar trade names)

contains the carcinogen PCB. However, the quantity contained in circuit

breakers is measured in tens of gallons (instead of thousands of gallons

as in a main transformer) and is subject to heating only briefly during

its operating cycle. If a spill does occur, its results and cleanup are

usually a minor problem unless the fluids are allowed to flow into systems

not designed for their containment. If the drain, for instance, is into a

local system that empties into the storm drain, then there may be environmental contamination requiring considerable effort to mitigate.

6.2.3 Toxic Fumes

The fumes that can be generated by circuit breakers in a fire situation are limited by available materials and normally will be contained

within their own cubicle or vault, thus not exposing equipment physically

separated from them. The fumes that do escape the local circuit breaker

containment are very irritating and can be toxic, depending on the source

material. Personnel access and ventilation must be carefully controlled

in these circumstances.

6.2.4 Fire protection system

The protective systems for circuit breakers may vary from watersprinkler diluge arrangements in the switchgear room where the largest

indoor breakers are located to O0, and/or Halon in the load center vaults.

The protective system is designed so that its operation does not directly
29

affect the functioning of the breakers, and because of the limited amount

of flammable fluid and material available, the possible extension of any

fire situation is quite limited. Although the fire may be largely confined, it may disrupt the nearby control and metering circuitry such that

incomplete or incorrect information is displayed.

6.2.5 Mechanical stress

As a breaker acts, in particular when it opens the circuit, its containment is designed to withstand the forces involved. Even functioning

under excessive loading conditions, which may destroy the circuit breaker

itself, does not produce strain or involve physically more than the cabling or buswork directly attached to the unit itself.

6.3 Lightning and/or Surge Arrestors

The lightning and/or surge arrestors reviewed were mainly those of

the switchyard itself. These are normally located on the high- and lowvoltage sides of the station, auxiliary, and startup transformers. Such

arrestors have a long history of reliable performance under their design

conditions. Through scheduled service and with careful maintenance, their

availability and reliability are quite high. However, if there are multiple surges in rapid succession that do not give the arrestor time to recover or to dissipate the heat built up, the unit may fail.

If the line terminating an arrestor functions as designed, the

smaller surge elements located indoors are seldom required to function.

Most failures are therefore confined to the units associated with the

switchyard and transmission lines.

6.3.1 Energetic missiles

The very function of the lightning arrestor involves the dissipation

of large amounts of energy in a short time span. Any failure of the unit

is therefore sometimes characterized by the ejections of portions of the

ceramic insulator container as missiles. These missiles may weigh up to

10 lb and may be projected some 30-50 ft.

6.3.2 InsulatinE fluid spills

Lightning arrestors presently being installed in nuclear facilities

are solid-state or gas-filled units and do not contain any quantity of

toxic or flammable liquids.

6.3.3 Toxic fumes

(See Sect. 6.3.2.)

6.3.4 Fire vrotection system

(See Sect. 6.3.2.)
30

6.3.5 Mechanical stress

When it fails, the arrestor may import a mechanical jerk to the transmission line or buswork to which it is connected. It may also conduct

enough current that the self-induced magnetic field interaction may physically move the connecting cable or buswork, but it is highly unlikely that

either of these effects could contribute to spatially separated parallel

circuits.

6.4 Cables and Connectors

The transmission line and switchyard cabling is quite widely spaced

by design and has little potential for failure coupling modes between circuits. "Galloping" bore conductors on long transmission line spans can

and do cause phase-to-phase flashovers, but this condition is limited to

the same circuit. Interior cabling, which is generally insulated, is

often placed in close proximity to cables of other circuits and is located

in the same or adjacent mechanical supporting device (tray or racks). The

cables with their own ground shield and mechanical protection will short

together only under most unusual conditions (fire, excessive heat, or repeated cyclic movement), but surge currents and temperature-caused forces

may place mechanical strain on their own connectors and mountings. Physical contact with adjacent cables may also induce problems in other circuits.

The problem of overheating and burning, always present in any singleor multiple-cable installation, was demonstrated by the Browns Ferry cable

fire (see Sect. 4.4 and Refs. 6, 7, 17, and 31). However, recent developments in retardant coatings and new insulation compounds promise to reduce

the risk of cable fires starting and spreading.

6.4.1 Enerietic missiles

The only damaging missiles from cables and connectors that were considered were droplets of molten insulator or insulator material that could

result from arcing and/or burning. These droplets, propelled by rapidly

expanding gases or induced magnetic fields, can cause damage to nearby

insulators and associated equipment. Because of their small size, however, the droplets have limited range and tend to deposit on rather than

penetrate impacted surfaces. The range limitation plus cooling in flight

confine the additional damage usually to the same curcuitry, except when

the initial fault is in a cable tray or rack with other circuits.

6.4.2 Insulatina fluid spills

With few exceptions, the cables considered do not have any fluids as

such associated with them. There are a few oil-insulated and oil-cooled

HV cables whose use is characteristically limited to individually carefully designed situations. These installations are unique and have special consideration for containment and/or fire protection. (Municipal

power distribution systems use a great number of oil-filled cables in congested areas.)
31

6.4.3 Toxic fumes

Cable insulation and protective coverings used in older cables were

usually oil-impregnated paper or varnished cambric, but most of the currently installed cables have plastic insulation that is some form of PVC.*

When PVC burns, it melts and generates dense smoke and large quantities of

soot. The fumes and soot deposited from combustion of the insulation can

cause insulator coating and failure. The molten, dripping, burning PVC

material can itself propogate the fire by dripping and depositing on flammable substances. 4 ,6, 1 1

-20 The burning PVC releases chlorine which when

combined with water will react with metallic electrical circuitry components. The chlorine will also react with other metallic equipment.

6.4.4 Fire protection system

Cabling or buswork areas normally have fire detection systems (ionization or heat rise) and some means of fire suppression. The fire-suppression systems may be supervized automatic, direct-acting sprinkled CO2,

or Halon diluge systems. The choice is site, location, and designer specific. Most facilities use a supervised sprinkler system, but in some

cable-spreading areas (different from cable tray runs throughout the

building) CO. diluge and soak systems are preferred.

6.4.5 Mechanical stress

The whipping action caused by fault currents and the expansion and

contraction from interior cable temperatures can place mechanical stress

on the mountings and electrical connections of power cables. Electromagnetic forces between cables carrying large fault currents, other cables,

and metallic conductors can result in physical displacement, breakage of

mounting insulators, and rupturing of containment. The effects of temperature are generally accumulative and can be measured so that corrective

action can be taken. Connections and mounting points may also be overstressed during assembly or disassembly unless proper support and procedures are provided. The support and procedures are especially needed

if the cables are used as removable links where handling is much more

frequent.

6.5 Control Boards (High Boards)

A control board functions as the mechanical mount of various pieces

of electrical equipment such as meters, switches, circuit breakers,

cables, low-voltage distribution transformers, and display equipment. The

control board itself can only fail structurally, which is very unlikely unless the floor and/or building moves from a seismic or some other largescale event. Thus, any control board faulting will be the direct result

of some of the attached equipment, as described previously for the various

components.

*Some gas-filled (SF,) breakers are under design studies.
32

7. CONSEQUENCES OF COMPONENT FAILURES

IN NUCLEAR POWER PLANTS

The consequences of component failures in nuclear power plants are

potentially very great, but good engineering based on applicable standards, codes, and regulations and many years of design and operating experience in the public utility industry have reduced the probability of

equipment-initiated events.9, 2i Single-failure fault probability for

major pieces of electrical equipment is on the order of 0.01 failure per

year.le

The review of the FSAR drawings and plant visits for this report were

an effort, by inspection, to determine if a unique installation existed

where a fault (-0.01 failure per year) could be expected (at least one

out of ten times) to propagate an extension of the basic failure. Attempts were made to place known faults of record, personal experience, or

those faults whose potential could be delineated into circumstances where

the initial fault became the precursor.

The plants and their electrical equipment varied greatly, from single

generating units to multiple units, 115- to 500-kV switchyards, oil-filled

to dry transformers indoors, and alarm-only to completely automatic fire

systems. All plants, in their own ways, show good engineering and the

impact of NRC regulations, applicable codes, and standards. In the plants

visited, the separation of the essential safety function was quite evident. As would be expected, equipment not related to safety does not have

the same separation and protection and may thus be more easily involved in

a cascading event (that would not jeopardize the plant's safety). For

instance, one plant with dry transformers has a distribution transformer

installed adjacent to several nonsafety-related instrument and service

vertical cable trays. A massive failure of this transformer possibly

could disrupt elements of these cable trays. Also, one plant has its nonsafety-related station service switchgear located in two adjacent rows

such that any violent major switchgear failure might not only involve the

buswork of the failing switchgear but the buswork connecting adjacent gear

as well. However, visits to plants and examination of drawings and FSARs

revealed no installation whereby even a massive electromechanical failure

of any electrical component could prevent the ability of any additional

safety system to function properly.

7.1 Transformers

In all cases reviewed, transformers were protected by fire shielding

walls and spatial separation and were provided with either a direct-acting

or supervised automatic sprinkler or fire alarm system.

7.1.1 Energetic missiles

Although no failures can be traced to missiles generated from and by

transformers, in several instances missiles from the ceramic insulators

have been recorded. These missiles were 3 to 7 lb in weight and had been
33

projected some 30 to 40 yards, in one case severely denting an access

door. They could obviously have damaged other ceramic insulators on adjacent equipment and other impact-sensitive elements.

7.1.2 Insulating fluid spills

The oil-filled transformers may contain mineral oil or an insulating

oil containing PCB. Both fluids are flammable, but the PCE poses the additional problem of carcinogenic material cleanup. The large size of the

external main and auxilliary transformers and the volume of fluid they

contain (thousands of gallons) create problems in filtering and changing

the oil unless the connections are permanent. For permanent connections,

the pipe is placed in a trench through the switchyard, between the transformers and the filtering-pumping station. This could lead to trouble if

there is a leak from the pipe into the trench which could be ignited by an

external source such as a flaming oil spray from a faulting transformer.

Fumes from such a burning transformer in some instances are exhausted

directly to the outside air through roof vents placed directly over the

transformers. The fumes would then be spread by the wind to other areas.

Because of the possible toxic nature of these fumes and the characteristically thick, dense smoke from the burning oil, visibility and mobility

of personnel in these areas for control and repair may be severely

limited.

The indoor oil-filled transformers observed were all protected by a

supervized sprinkler system and were curbed to contain the fluids. The

problem here would be toxic fumes and cleanup, especially if the insulating fluid contained PCB. The only drains were floor drains to tankage not

intended for carcinogenic material.

7.1.3 Fire Protective systems

The oil-filled transformers were all protected, but some of the interior dry transformers were protected by alarms only. The alarm-only

system is geared to a fast human investigation and response with manual

equipment. The problem of toxic fumes from burning insulation would require the use of self-contained air masks as well as fire extinquishment

equipment for those entering the area.

7.1.4 Mechanical stress

The structural strength of the switchyard bus associated with the

main transformers, although not seismic qualified, is mechanically sturdy

enough that the chance of failure is quite remote for any force resulting

from a transformer failure. The indoor distribution transformers are

usually connected by flexible cable and can through cable whip overstress

cable tie-down clamps and connectors to the point of failure.
34

7.2 Switchiear

Switchgear varied from the 500-kV magna and pneumatic circuit breakers through the oil circuit breakers used in switchyards to the indoor

medium-voltage air circuit breakers. Although they were not specifically

addressed, load and isolation disconnect switches were considered when

convenient.

7.2.1 Energetic missiles

Circuit breaker failure rarely generates missiles large enough in

themselves to be damaging, but because of the very concept of interrupting

(and dissipating) large amounts of power in extremely short times the potential for an explosive failure is always present. The indoor circuit

breaker, usually air or in some cases oil, is more likely when failure

occurs to spray molten copper or oillS,1? on the connecting bus and its

insulators and to damage contiguous cabinets and control circuits.

7.2.2 Insulating fluid spills

Little documentation was found on the long-term effects of the gas

SF.; none of the plants visited had any information. The Askeral (and its

PCB) used in the oil circuit breakers is of small volume and seems to make

only a minor contribution to failure problems.

7.2.3 Toxic fumes

Not applicable.

7.2.4 Fire Protection systems

Reference 17 was the only document giving any applicable information.

7.2.5 Mechanical stress

Not applicable.

7.3 Lightnina Arrestors

Failure of lightning (surge) arrestors usually involves failure to

correctly function because of insufficient time for proper recovery between demand strokes. In this case it effectively remains a shunt on the

line, dissipates energy far beyond its rating, and destroys itself. The

other failure mode is where the gaps and grading elements become ineffective and the arrestor ceases to function as a suppressor or fails to withstand impressed voltage. The first fault mechanism possibility is greatly

reduced by correct selection of the arrestor; the second mechanism can be

almost eliminated by scheduled maintenance.
35

7.3.1 Enerietic missiles

Although several destructive failures (Table 4) were listed as noted

in Appendix A, there were no reports that indicated any subsequent failures of other equipment from missiles originating from the lightning arrestors.

7.3.2 Insulating fluid spills

See Sect. 6.3.2.

7.3.3 Toxic fumes

See Sect. 6.3.2.

7.3.4 Fire protection system

See Sect. 6.3.2.

7.3.5 Mechanical stress

No instances of the mechanical contribution of lightning arrestors

were found (see Sect. 6.3.5).

7.4 Cables and Connectors

The large connectors used in switchyards are usually hollow tubing,

but some installations connect bus to units such as circuit breakers with

large heavy unshielded cables. These cables are sometimes also used as

disconnecting links to be used when the breakers or other units are undergoing testing or maintenance. The greatest use of insulated cables is indoors where the distribution voltage is generally limited to not more than

13.8 kM.

7.4.1 Energetic missiles

Not applicable (see Sect. 6.4.1).

7.4.2 Insulating fluid spills

Because few cables containing insulating oil or gas are used in

nuclear plants, there is no record of failures involving other than the

initial fault. However, facilities that do use such cables (in trays or

trenches) must give consideration to the proximity of the cables to

sources of ignition and potential fuel.
36

7.4.3 Toxic fumes

Actual generation of fumes by cable fires in practice is rather

rare,*,6,1,'- 1 7 5 but the possibility is always present. Indoor cabling

is now required to meet coding and installation requirements designed to

further reduce the potential for failure.

7.4.4 Fire protection systems

Most facilities have automatic fire protection systems (Sect. 6.4.4),

but the suppression mechanism may be manual.

7.4.5 Mechanical stress

Cables mechanically work in the cable trays and will occasionally

mechanically abrade the insulation to the point of failure. The use of

cables as disconnecting linkage should be carefully considered because of

their size and required length. Such linkage usually will require the use

of scaffolds or a cherry picker and manual handling of the lines (cables).

In bad weather or emergency situations the potential for problems surely

exists, and it does not seem to be cost effective to use such a system in

place of a mechanical no-load switch.

7.5 Control Boards

Control boards as such will fail only if some installed equipment

initially faults.s,Ll Possible problems for equipment servicing in the

boards may result from backfitting of seismic supports, but this will

likely be more of an inconvenience than a real problem.
37

8. DISCUSSION

Reaction to an unscheduled event, electrical or otherwise, is quite

easy to predict after it has occurred, but it is extremely difficult to

accurately predict for future events because the events themselves and

their ramifications often do not become clear until the event actually

occurs. Modern nuclear power plant engineering uses standards, good design techniques, and fault-tree analysis to limit the occurrence of unscheduled events and to curtail their damage potential. But the one element that interfaces with the equipment and is often incompletely programmed is the operator. If failure to take action as well as incorrect

action is considered, it seems that 30 to 50% of disruptive events are

caused by human error. 1 3,22,82 In all fairness, it should be pointed out

that the multitude of correct human responses go undocumented and unpublished and receive very little recognition except in the exemplary nuclear

industry safety records.

The very size and complexity of nuclear power plants has as a direct

result introduced a degree of specialization in engineering and operation

that makes keeping in mind the overall picture most difficult. But in

spite of the magnitude and sophistication of nuclear power plants, more

hands-on training and interaction between operations, engineering, and

maintenance personnel at all levels is a must. This information exchange

can be fostered by a series of "exchange-professor" systems whereby a design specialist works with maintenance on an exchange basis for a prescribed time period or an operator is assigned to maintenance scheduling.

Knowledge of the equipment operating conditions, necessary environment,

and possible failure mechanisms can help avoid initial failures and the

contribution these failures can make to additional damage.

One of the feelings that became apparent from talks with personnel at

the plants and with construction and design engineers was that the person

who remotely controls the equipment has less and less contact with the

equipment and its characteristics. This is unfortunately true; but time

limitations place quite severe restrictions on the appreciation of equipment capabilities received through hands-on experience. The turning of a

switch in the control room does not always fully indicate (except by displays) the events that take place at the other end of the control circuit.

Few operations or design staff have the chance to develop the "sense" that

something is not quite right. This sense, developed through experience,

is made up of sounds, feelings, and timing that are mentally integrated

and coupled with past experience to indicate that something is not quite

as it should be - something needs checking.

The tremendous amount of technical and scientific knowledge that

must be assimilated and used daily by the staff is so different from the

highly specialized skills of the craftsman that no longer does the staff

sense directly the conditions of operations and equipment. Instead, the

staff now must rely on displays and communications. Gone also is the

feeling of "that is my piece of equipment." The locomotive engineer

senses something is not right with his traction unit, so he compensates

in his control until he can get to the shop. Once in the shop, he will

discuss the problem directly with the repairman, and if it is not corrected he will be back face-to-face with the repairman. In this example,
38

the operator is directly and physically involved - which is not possible

in a nuclear power plant. Increased communication loops on a continuing

basis can be of great assistance in reducing the problem.

Electrical equipment, properly designed and installed according to

NFPA, IEEE, and ANSI standards and the Standard Safety Analysis Report

GAISSAR, 1 1 plus NUREG and DOE publications, has little chance of failure,*

but sneak circuits and spurious couplings can create problems. Engineering and fault-tree analysis, coupled with ongoing quality assurance (QA)

in installation and maintenance activities, is necessary to ensure that

all standards are met and failure rates are kept at a minimum. TVA and

the Arizona Public Service have a QA section in their design engineering

that is part of the engineering process from concept through design specification, procurement, installation, and, finally, startup testing. The

responsibility of these QA people is to ensure that the total equipment

capability is available to the operators. This type of commitment will,

in the long run, mean that equipment operates as expected and failures

will be minimized.

Manufacturers and industry servicing, testing, and maintenance procedures and schedules must be followed rigorously with any deviation in

the data thoroughly investigated. Utilities the size of TVA have a large

enough system and enough equipment of various sizes that statistical

analysis can be used to project needed changes in testing or maintenance.

It may well be that the already low electrical equipment failure rate

cannot be greatly reduced, but if the correct response can be programmed

by both the automated equipment and the operations personnel, the circumstances that contribute to follow-on failures can be eliminated. It could

just be that the time has come to take a hard definitive look at when and

how the operator enters into the event cycle.

*WASH-1400 (Ref. 10) gives failures per ypar ranging from 0.3 (breakers) to 0.003 (transformers).
39

9. CONCLUSIONS

The difficulty of finding electrical equipment failure information is

indicative of the very infrequent and random nature of the events. In

addition, because each failure is uniquely characteristic in fault mode

and type of equipment, no valid statistical analysis for trends could be

established. In fact, no instances were found during plant visits or on

examination of plant drawings or FSARs where any failure in one electrical

safety system would affect the safe shutdown capability of the plant. The

lack of data does, however, seem to indicate a high reliability and low

failure rate of modern electrical power equipment. Diligent application

of the appropriate codes, standards, and regulations will continue to establish the basis on which safe design and operation will be founded.

Research on materials and development of improved techniques and methods

will continue to provide improved reliability and safety in the nuclear

power industry. 1

°,34-34 Based on the information presented and discussed

throughout this report, we have come to the following conclusions.

9.1 Transformers

Transformer failures, while infrequent, are usually the culmination

of a series of events: unusual loading, impressed surges (from protective

circuitry failure or local switching), or improper maintenance. Nearly

always, incipient failures can be determined by instrumentation, and preventive maintenance will ensure resolution of the condition. If, however,

the transformer does fault, other connected or adjacent equipment is protected by the sensing elements and series circuit breakers. Any fluid

spill or fire activates the required extinguishment system. There is

very little probability that even a major transformer fault will mechanically damage any equipment other than itself. The mechanical damage will

largely be confined to nearby piping, support structures, or electrical

connections. The possible spill of flaming transformer oil into a trench

carrying either oil-filled cables, hydrogen supply lines, or the transformer oil-filtering piping could easily involve areas and elements of

equipment not electrical in nature.

There is, of course, a small chance that projectiles from the bushings could impact on ceramic supports or feedthroughs of other nearby

equipment and contribute to their failure. However, with the required

spatial separation and/or protective walls and with the required alternate sources of power, plant safety will not be jeopardized even if a

transformer does fault this way.

If the transformer fault involves arcing between the high-voltage and

low-voltage windings, the physical damage resulting from the fault may

well extend into the low-voltage buswork and connections. With the required alternate sources of power, plant safety will not be jeopardized

even by this type of fault.

9.2 Switchaear

Switchgear, because it is an active element, has a very definite service life determined by number of operations (wearing of parts) as well as
40

the inherent long-time component deterioration. Periodic testing and

scheduled replacement of worn parts greatly increase the reliable service

life of these units.

Circuit breakers may fail, not only in an obvious event, but also by

simply not actuating (either opening or closing) on command or actuating

in a spurious manner. Quite often the circuit breaker receives the blame

for the event when in reality the fault was caused by incorrect sensing

and control circuitry. Faults of circuit breakers can be locally violent

and offer the possibility of fire; but because of their location within

metal cabinets and/or their own steel-ceramic shells, the likelihood of

further damage is minimized. Spurious operation can create unwanted situations, but careful design and adherence to codes, standards, and regulations, plus engineering analysis for sneak circuits, will maintain high

reliability of unit and circuitry. Periodic testing will ensure that

protective relaying is adequate and properly calibrated.

9.3 Lightnina Arrestors

Lightning (surge) arrestors, like transformers, are on-line, but

their capabilities are required only during abnormal circumstances. An

arrestor is designed as a protective device so that its inability to respond may endanger the equipment and circuitry it is intended to protect.

Unless circumstances demand its function, an arrestor's inability to respond may go undetected for some time. Therefore, lightning (surge) arrestor failures are largely found during scheduled periodic testing or

when apparent problems with associated equipment are being resolved.

It is fortunate that circuit monitoring (recording voltmeters, oscillograph and oscilloscope traces) indicates the conditions under which

arrestors respond; these records should trigger inspection, testing, and

service. Unless the unit self-destructs from excess load, with proper

care it will be capable of long reliable service.

9.4 Cables and Connectors

Cables and connectors properly installed and not subjected to mechanical forces, moisture, or extreme temperatures have a predictable

long service lifetime. This lifetime is dominated by the aging of the

cabling material, especially its insulating medium. Cable failures, very

random in nature, normally only affect a short length of a specific cable

and are cleared by the protective relaying and feeding circuit breakers.

Usually, if required, the cable can be repaired by splicing and replaced

in service. In conduit, cables seldom can involve other cables or equipment, but when the cable is in an open tray with other cables, it can

directly affect others through mechanical motion or by heating (fire).

Relays with sensors, properly designed, installed, and kept calibrated,

will clear cable faults in an extremely short time (a few cycles ac) and

thus restrict the damage to the faulting cable.
41

9.5 Control Boards

Control boards are made up of many electrical components, such as

sensitive monitoring and control devices as well as smaller circuit breakers. The circuit board and its components are subject to mechanical and

environmental (water and fumes) damage; but usually the control elements,

not the installed circuit breakers, buswork, or cabling, are most likely

for externally induced damage. Regular hi-potting (high potential testing) for changes in insulation and power-factor measurements will disclose

incipient faults and will allow repair or replacement during scheduled

outages rather than after a fault.

9.6 Other Equipment

Test equipment is a vital part of electrical equipment service and

maintenance; as such it must be kept calibrated and available. Inaccurate readings, improperly used as functional data, can easily contribute

to a subsequent failure of an in-service component. Regularly scheduled

and documented calibrations ensure that monitored and/or tested equipment

is correctly evaluated.

It is extremely important that within the codes, standards, regulations, and the utilities' own specifications, good maintenance and operations records be kept. These records, intelligently analyzed, will often

indicate a potential fault or area of concern long before any actual event

occurs, thus keeping minor troubles from repeating or becoming major problems.

As new information or requirements from technical or regulatory bodies become available, they must be included in the operational requirements of present plants and should be made available for design and procurement groups. This updating will continue to improve the reliability

and reduce the failure rate of electrical power equipment. Assessment of

data and information obtained in this study indicates that initial equipment failures that require a man-machine interaction offer a very definite

opportunity for an incorrect response. The conclusion was reached that

the greatest decrease in fault cascading will be the result of increased

realistic training and better diagnostic information displays. While most

events reviewed were very dissimilar in both equipment and fault mechanism, many instances of incorrect or incomplete man-machine response contributed to the damage total. Only the best training and the most complete information will enable the operator to assess adequately the situation and to respond correctly.
42

10. RECOMMENDATIONS

Recommendations derived from this study fall into two categories:

(1) those of a general nature that apply to the entire electrical system

and involve such activities as better q-dality assurance, better procedures, better failure documentation, and better information exchange and

(2) those specific to individual electrical components. Even though the

discussion of those recommendations specific to individual components may

appear to be directed solely to the prevention of the failure of that component, it is through a gross failure of one component that the failure is

propagated beyond the component itself. In addition recommendations are

included whose specific intent is to minimize the potential of failure

propagation beyond a failed component itself.

10.1 General Recommendations

10.1.1 Color codina

So that the chance for error during normal operations and maintenance

can be minimized and emergency response can be expedited, a color coding

and numerical standard should be developed and implemented for use in plant

electrical systems. This system should include a distinctive color (e.g.,

orange, purple) and voltage level indication (e.g., 1, 2, 3) for each

safety and/or service system. This is normally done in most plants during

the initial installation phase, but in any event some coding should be used

on electrical equipment. Such markings will reduce error, will speed service response for operations, and will be helpful in emergency situations.

10.1.2 Emersency procedures

A locally available manual should describe both the concerned equipment and the actions to be taken in fire and other emergency conditions.

Emergency procedures in use at Oak Ridge National Laboratory require that

each area have a posted emergency evacuation route, a means of notification, and an emergency manual (located in a central spot in a plastic container). This manual describes the expected response of. personnel normally within the area (and an index of their training) and the actions to

be taken in an emergency. The hazards and restrictions of the area are

Indicated, and the authorization requirements for access and action are

outlined. The location of fire suppression equipment, communications capability, and lighting and ventilation controls must be adequately described. It is recommended that consideration be given to the development

of a guide that can be used by nuclear plants to implement the writing and

installation of similar manuals.

10.1.3 Electrical system display

All nuclear plants' plans for upgrading should include as an ongoing

effort continued training improvement and more informative diagnostic
43

displays. The growing use of ergonomics is to be commended, but diagnostic displays that portray changing conditions and trends will enable better judgments to be made of the situation at the man-machine interface and

thus will minimize the opportunities and likelihood of human errors. It

is therefore recommended that (1) research be continued on computerized

data display and (2) generic simulators be programmed to test the results.

10.1.4 Diesel Renerator switchina

Final Safety Analysis Reports and discussions with operators show

that all plants have procedures and automated controls of the onsite emergency diesels that properly connect to the system In an emergency. The

return to offsite power operation is not so well described, and the problem of synchronizing the diesel and its load to the network before reconnecting needs to be clearly understood and provided for. If the system

is to be fast switched (within five cycles), then there must be a method

of synchronization; if the return to normal supply is other than fast

switched, then it must be done after the diesel has been disconnected and

the loads (motors especially) have coasted down to where the back electromotive force is 25% or less of that rated. This slow-switching will of

course again create startup current surges, but they will be within normal

limits and will not be destructive in nature.

Therefore, the recommendation is made that the plant safety analysis

reports and electrical operating procedures be reviewed to ensure that the

problem of reconnection to the transmission network is defined and that

either fast or slow switching is designated.

10.1.5 Maintenance scheduling

With the cost of equipment growing higher each day, the expense of

repair and maintenance, plus the loss of revenue from nonoperating equipment, clearly failure rates of major equipment must be minimized. Regular

periodic maintenance scheduled in conjunction with other outages (e.g.,

during fuel reload) is not only less costly in equipment and manpower,

but it allows system load projections to become part of the calculation.

10.1.6 Electrical advisory panel

A panel of engineering experts should be established to assess failure information pertaining to electrical power equipment. This panel

would be available to consider potential or actual problem areas, to make

recommendations for their correction, and to give input to the various

agencies that write national standards and codes, the Advisory Committee

on Reactor Safeguards, and various NRC divisions as needed.

10.1.7 Eguipment failure data systems

Clearly a system such as the Government Industry Data Exchange Program (GIDEP) (see Appendix B) or an improved nuclear plant reliability
44

data system (NPRDS) tailored directly to the nuclear power industry would

be most useful. Such a system should be capable of providing (1) notification at the level needed; (2) rapid, specific notification of occurring

and potential problems and failures of systems; and (3) components and

materials of interest to the operations and maintenance supervisors. This

notification and information exchange network must be operated by an obviously impartial group. The GIDEP system, while similar to the NRC inspection and enforcement (IE) information notices and the Institute of

Nuclear Power Operations NPRDS, has additional features that could be advantageously incorporated into both IE and NPRDS. These features include

(1) extremely short times between initiation and issuing of notice and

(2) unique packing with copies of the initial report and the equipment

manufacturer's comments presented on distinctive, easily identified paper.

For information input, GIDEP has an onsite representative who is responsible for formulating the original factual submission to the central

clearing house and publishing agency. This same individual is also responsible for proper and complete onsite distribution of "alerts" and

"safe alerts." Of major concern to the GIDEP system is the timely distribution of concise factual information in an easily recognized and readable

format. This designated individual contact is also listed on a roster

that each active participant is given, so that quick contact can be made

for more detailed information and the direct exchange of ideas.

10.1.8 Failure documentation

Present plant equipment maintenance and failure documentation is often incomplete. LERs report Technical Specifications violations and do

not completely reflect the full picture of equipment problems. The only

way the additional information can be obtained is by surveys of specific

equipment histories in a designated time span. For this additional information it is recommended that information from LERs (and other available reports) for a representative number of plants be compared with

documentation of work requests and repair costs from those plants. This

should provide a direct comparison and statistics that could be used for

scheduling and projecting maintenance costs and manpower needs. As an

alternative this could be a specific part of the present IEEE Electrical

Reliability Study. Better testing techniques and probabilistic data that

the utilities can use to coordinate their service schedules should emerge

from these studies.

10.1.9 Quality assurance

In spite of the detailed specifications under which medium- and highvoltage electrical equipment is purchased, a rigorous QA program must be

followed. Maintenance, servicing, and QA records can form the basis for

design and installation modifications.

10.1.10 Trainina program

Incorrect human response was the aspect of the reviewed electrical

failures that was repeated too often. Operators with more experience and
45

maturity had significantly fewer errors of judgment. The present inservice time of junior and soon-to-become senior managers is not adequate

for them to get enough hands-on experience with the equipment. During the

early on-the-job time, experience in several fields (e.g., design, procurement, maintenance) can help when judgments are required at the staff

and managerial levels. The junior management training program should provide the opportunity for experience in all areas of equipment operation.

The broadening of the experience base cannot be emphasized too much or too

often because of the large contribution human responses play in all failure modes.

10.1.11 Information exchange

At the present time information on electrical failures in the nuclear

utilities is collected and distributed by a number of organizations, such

as NPRDS, NSIC, and EEl. However, no one organization has complete files

of information or distribution capability. One of the keys to further

reducing the consequences of equipment failures is the exchange of information between regulatory bodies, the utility users, and equipment manufacturers. So that the exchange of information can be free and unlimited,

It is suggested that regularly scheduled workshop conferences be held.

These conferences might be similar to the present annual Doble Clients

Conference. The Doble conferences are some of the most current sources of

information on electrical equipment uses, maintenance, and operating experience available. Although these conferences are not presently nuclearindustry specific, they do cover power operating experience and preventive

maintenance testing of distribution, generation, and power equipment.

Accomplishment of information exchange can take place any of the

three following ways. As a minimum, nuclear power plant electrical design

and service personnel should be encouraged to attend the present conferences and familiarize themselves with the experience of others in the public utility sector. This would be the quickest and least costly approach,

but it would be limited largely to the experience of nonnuclear plants.

The second alternative would be to work out an agreement with the

Doble organization to set up a specific parallel series of workshops for

the nuclear power generation group. These sessions could be in the same

format as Doble's other sessions but should recognize the special conditions imposed by nuclear plants.

The third procedure would be for NRC to sponsor regular workshops

through an independent group. The sponsoring organization of record must

be not only impartial by name but by reputation so that the flow of information will not be restricted in any way.

10.2 Recommendations on Specific Electrical Equipment

From the review of electrical equipment failures reported herein,

it was concluded that the relatively few damaging failures for which documentation was obtained were a direct consequence of failure to follow any

or all of the well-established and well-known practices of electrical
46

engineering, design, construction, operation, and maintenance of highvoltage electrical equipment. Therefore, a general recommendation pertaining to the high-voltage electrical system components that follow is

to urge strict adherence to established practice. In addition, the following recommendations address certain aspects concerning the safety of

specific equipment.

10.2.1 Transformers

Many of the present power transformers, located both inside and outside, are filled with insulating oil that contains PCB. Not only must

provision be made to contain the spillage, but care must be taken to ensure that insulating fluid is not introduced into drain systems and areas

where cleanup and disposal become a problem.

If the inflammable insulating fluid does burn, the problem of containment may be exacerbated because the fumes must also be controlled and/

or contained. Therefore, it is first recommended that a specific written

procedure be followed for fire suppression and/or cleanup of fluid spills

where oil-filled transformers are used. Second, it is recommended, in

addition to regular periodic servicing, that after any overvoltage, excessive surging, or system faulting, the electrically connected and associated equipment be analyzed and tested before being returned to service.

Any time a transformer is opened for inspection, repair, or storage,

there is a chance that air (and moisture) may replace the inert cover gas

or insulating fluid. For this reason it is recommended that the procedures and practices provided by the equipment manufacturer be strictly

followed, particularly if periods of storage are necessary.

10.2.2 Circuit breakers and/or switchnear

Medium-voltage circuit breakers, both oil and air, are designed to be

easily removable for testing, calibration, and maintenance. This capability to be mechanically repositioned is not intended for use in electrically closing or interrupting the circuit. Because the mechanical

movement involves the electrical connection point, correct alignment for

each reinstallatlon is critical. If the contact points (stabs) are incorrectly aligned or insufficiently inserted, a hot spot and a potential

for failure result. Therefore, the QA program for operators should ensure

that (1) the manufacturers' test, calibration, and reinstallation procedures be carefuly followed; (2) if upon inspection evidence is present of

overheating or arcing, the mechanical alignment mechanism be checked for

wear and out-of-tolerance adjustments; and (3) if any evidence is present

of external arcing, insulating fluid spillage, or other indications of

abnormal conditions, a job plan be established before further maintenance

or service is performed.

10.2.3 Lightninx (surge) arrestors

Historically the installation or elimination of lightning arrestors

has been a cost vs risk consideration. Because of increased size and
47

replacement costs (downtime, replacement power, and public image), system

fault response calculations should be ongoing, with the cost-risk consideration periodically considered.

The lightning arrestor, in spite of being a passive element, is one

of the most important protective units that can be applied to an electrical system. Its properly designed installation, maintenance, and servicing therefore cannot be overemphasized. If it fails in its function, so

also will some other (perhaps more expensive and less easily replaced)

part of the system fail.

10.2.4 Cables and connectors

Records of periodic inspection and testing of cables need to be incorporated into trends analysis from which service and replacement schedules can be projected. Accordingly, it is recommended that a central collection and analysis system be developed. This system would be helpful in

establishing site and generic failure mechanisms and the projected trends

that can be used in scheduling preventive maintenance.

Connectors fastened by screws, bolts, or spring-loaded contacts require routine cleaning and retorquing to reduce excessive local heating,

which can ultimately lead to failure.

Development of a cable insulation that has better flame retardant and

aging characteristics is greatly needed. Therefore, it is recommended

that NRC, jointly with other organizations (e.g., EPRI, IEEE, NEMA), continue to sponsor research and development activities such as the Sandia

work', 8 . on (1) solid cable insulation (its combustibility and aging

characteristics); (2) gas insulation used in cables, transformers, and

switchgear; and (3) environmental impacts of distribution systems with

ultra-high voltages.

10.2.5 Control boards

Control boards have been known to fail mechanically because of faulty

welds or inadequate structural design. However, unless the installation

or subsequent additions increase the stress levels appreciably, the greatest fault potential is from an outside event such as fire, water diluge,

or loss of building structural support. Routine, periodic inspection of

the control board and its attached components should provide information

on potential structural problems long before maintenance is required.
48

REFERENCES

1. S. Ahmed, P. R. Metcalf, and F. W. Pegram, 1Uncertainty Propagation

in Probabilistic Risk Assessment: A Comparative Study," Nucl. Eng.

Des. 68(1) (March 1981).

2. Nuclear Regulatory Commission, Draft Regulatory Guide and Value/

Impact Statement, Task RS 705-4, Division 1 (August 1979).

3. Nuclear Regulatory Commission, Main Transformer Failure at the North

Anna Nuclear Power Station, IE Information Notice 82-53, Dec. 22,

1982.

4. Leo J. Klamerus, A Preliminary Report on Fire Protection Research

Program Fire Barriers and Fire Retardant Coatings Tests NUREG/CR0381 (SAND-78-1465), p. 51 (September 1978).

5. Test Procedure for Evaluation and Classification of Insulation Systems for Direct Current Machines. Institute of Electrical and Electronic Engineers, IEEE-304 (1974).

6. Congressional Hearings 94th Congress, First Session, Part 1, "Browns

Ferry Nuclear Plant Fire" (Sept. 16, 1975).

7. R. L. Scott, "Browns Ferry Nuclear Power Plant Fire on March 22,

1975," Nucl. Saf. 17(5), 592-610 (September-October 1976).

8. R. Saher, Using Transformer Failure Data to Set Spare Equipment Inventoriess American Electric Power Service, Electric Light and Power

(October 1980).

9. European Atomic Energy Community, Proceedings of the Meeting of Specialists on the Reliability of Electrical Supply Systems and Related

Electro-Mechanical Components for Nuclear Reactor Safety, Iepra

(Italy), June 27-28, 1968j CONF-680666 (EUR-4517) (1970).

10. Nuclear Regulatory Commission, Reactor Safety Study - An Assessment

of Accident Risks in U.S. Commercial Nuclear Power Plants, WASH-1400

(NUREG-75/014) (October 1975).

11. Gilbert Commonwealth Companies, GAISSAR. Vol. 4 - Standard Safety

Analysis Report, Docket STN 50-595 (July 31, 1978).

12. Doble Instrument Company, Doble Client. Annual Conference Proceedingas published annually, Boston, Massachusetts.

13. A. D. Swain and N. E. Puttman, Handbook on Human Reliability Analysis

with Emphasis on Nuclear Power Applications, NUREG/CR--1278 (October

1980).
49

14. W. C. March, NRC Resident Inspector at Turkey Point, "Trip Report to

North Anna, Sept. 4, 1981," Docket 50-339.

15. Department of Energy, Idaho Operations Office, Investigative Report

of the Electrical Fire at the ICPP Substation Occurring January 11,

1982, February 1982.

16. Donald Beeman, Industrial Power System Handbook, McGraw-Hill, New

York, 1955.

17. Commonwealth Associates, Outages of Electric Power Supply Resulting

from Cable Failures - Boston Edison Company, DOE/RG/06674-01 (July

1980).

18. R. B. Williamson and F. L. Fisher, Teets and Criteria for Fire Protection of Cable Penetrations, NUREG/CR-2377 (SAND81-7160) (October

1981).

19. H. M. Schmidt and F. R. Kause, Burn Mode Analysis of Horizontal Cable

Tray Fires, NUREG/CR-2431 (SAND81-0079) (February 1982).

20. Melvin Abrams, Fire Protective Cable Tray Fire Test, Cincinnati Gas

and Electric Company, submitted by Construction Technology Laboratory, Skokie, Ill. (June 1979).

21. Code of Federal Regulations, Title 10, Chap. 1, Part 50, Appendix A:

General Design Criteria for Nuclear Power Plants, Jan. 1, 1982.

22. Lightning Protection Code, National Fire Protection Association,

Standard 78-1968.

23. Surge Arrestors for Alternating Current Power Circuits, American

National Standards Institute, ANSI C62.1 (1975).

24. Nuclear Regulatory Commission, "Millstone Nuclear Station Unit 1,"

Preliminary Notification PNO-I-82-19 (DN50-245), Feb. 17, 1982.

25. Application Guide for AC High-Voltage Circuit Breaker Rated on a

Symmetrical Current Basis, American National Standards Institute,

ANSI C37.010 (1972).

26. Switchgear Assemblies Including Metal EncZoeed Buej American National

Standards Institute, ANSI C37.20 and Supplements (1974).

27. Trial Use Guide for Class 1E Central Switchboards for Nuclear Power

Generation Stations, Institute of Electrical and Electronic Engineers, IEEE-420 (1973).

28. Criteria for Class 2E Power Systems for Nuclear Power Generation

Stations, Institute of Electrical and Electronic Engineers, IEEE-308

(1974).
50

29. Nuclear Regulatory Commission, Regulatory Guide 1.32, Criteria for

Safety Related Electrical Power Systems for Nuclear Power Plants,

Rev. 2 (February 1977).

30. Nuclear Regulatory Commission, Regulatory Guide 1.75, PhysicaZ Independence of Electrical Systems (September 1978).

31. Letter to Director of Nuclear Reactor Regulation, Subject: "Fire in

Cable Trays at Browns Ferry 1 and 2," Dockets 50-259/260, June 9,

1975.

32. Proposed American National. Standard Criteria for Safety-Retated

Operator Actions, American National Standards Institute, ANSI N660

(January 1977).

33. Nuclear Regulatory Commission, PRA Procedures Guide, Chap. IV, Vol.

1, Rev. 1, NUREG/CR-2300 (1981).

34. H. Inhaber, Risk of Energy Production, AECB-1119, Atomic Energy Control Board, Ottawa, Canada (1978).

35. F. R. O'Donnell and H. C. Hoy. Occupational Safety Data and Casualty

Rates for the Uranium Fuel Cycle., ORNL-5797 (October 1981).

36. Oklahoma University, Energy Alternatives - A Comparative Analysis.

May 1975.
51

Appendix A

SELECTED CITATIONS FOR EXAMFLES

53

TRAN SFORMER S

ACCESSION 122392

POWER LOST TO 161 KV/4160 V HOUSE SERVICE TFANSFORMERS AT FT. CALHOUN

1

5 PGS, LTR W/LER 50-285/77-4 TO U.S. NRC, PEGION IV, FEB. 28, 1977,

DOCKET 50-285, TYPE--PWP, MFG--COMB., AE--GIBBS & HILL

ACCESSION 125132

4160/440 VOLT TRANSFORMEF FAILS AT FT. CALHOUN 1

4 PPS, LER RO-285/77-16, MAY 24, 1977, DOCKET 53-285, TYPE--PWR,

MFG--COMB., AE--GIBBS & HILL

ACCESSION 125450

TWO SUCCESSIVE PARTIAL LOSSES OF OFF SITE POWER OCCUR AT TROJAN

4 PGS, LTR W/LEP 77-10 TO NRZ, REGION V, MAY 24, 1977, DOCKET 50-344,

TYPE--PWP, MFG--WEST., AE--BECHTEL

ACCESSION 125700

AUXILIARY TPANSFORP1ER DE-ENERGIZED AT THREE MILE ISLAND 1

4 PGS, LTR W/RO 77-15/3L TO NRC OFFICE OF I & E, REGION I, JUNE 28,

1977, DOCKET 50-289, TYPE--PWR, MFG--B.W, AE--GILBERT ASSOC.

ACCESSION 132926

STARTUP TRANSFORMER LOST DUE TO TRANSMISSION LINE FAULT AT

DAVIS-BESSE 1

3 PGS, LTR W/RO NP-33-77-106 TO NRC OFFICE OF I & E, REGION III, DEC.

22, 1977, DOCKET 50-346, TYPE--PWR, MFG--B&W, AE--BECHTEL

ACCESSION 133041

BOTH STARTUP TRANSFORMERS TRIP AT HATCH I

3 PGS, LTR W/RO 50-321/1977-71 TO NRC OFFICE OF I S E, REGION II,

OCT. 26, 1977, DOCKET 50-321, TYPE--BWR, MFG--G.E., AE--SSI

ACCESSION 1360 11

PREFERRED RESERVE AUXILIAPY POWER SOURCE LOST AT COOK 1

2 PGS, LTR W/RO 78-014/03L-0 TO NRC OFFICE OF I r E, REGION III,

MARCH 8, 1978, D3CKET 50-315, TYPE--PWR, MFG--WEST., AE--UTILITY

ACCESSION 136469

STARTUP TRANSFORMER BANK 5 TRIPS AT OYSTER CREEK

4 PGS, LrR W/RO 50-219/78-03/3L-0 TO NRC OFFICE OF I 6 E, REGION I,

MARCH 15, 1978, DOCKET 50-219, TYPE--BWR, MFG--GE, AE--BURNS & ROE
54

ACCESSION 139565

OFF SITE POWER LOST AT ST. LUCIE 1

4 PGS, LTR W/RO 335-78-17 TO NRC OFFICE OF I & E, REGION II, JUNE 13,

1978, DOCKET 50-335, TYPE--PWR, MFG--COIB., AE--EBASCO

ACCESSION 139826

STARTUP TRANSFORMER INOPERABLE AT OCONEE 1

3 PGS, LTR W/RO-269/78-15 TO U.S. NRC, REGION II, JULY 3, 1978,

rDOCKET 50-269, TYPE--PWR, MFG--B&W, AE--DUKE

ACCESSION 139975

STATION POWER TRANSFORMER LOST AT SALEM I

4 PGS, LTR W/RO 78-35/03L TO NRC OFFICE OF I & E, REGION I, JULY 20,

1978, DOCKET 50-272, TYPE--PWR, MFG--WEST., AE--PSE&G

ACCESSION 140145

4160/480 VOLT DRY TYPE TRANSFORMER CAUGHT FIRE AT FT. ST. VRAIN

5 PGS, LTR W/RO 50-267/78-28/01-T-0, FINAL, TO NRC OFFICE OF I & E,

REGION IV, AUG. 14, 1978, DOCKET 50-267, TYPE--HTGR, MFG--GA,

AE--SGT & LUNDY

ACCESSION 140190

SUDDEN PRESSURE RELAY TRIPS S/U TRANSFORMER FEEDER BREAKER AT FARLEY 1

4 PGS, LTR W/LER 78-055/03L-0 TO NRC OFFICE OF I & E, REGION II,

SEPT. 11, 1978, DOCKET 50-348, TYPE--PWR, MFG--WEST., AE--BECHTEL

ssI

ACCESSION 140335

ELECTRICAL FAULT OZ•URS IN STATION MAIN TRANSFORMER AT BEAVER VALLEY 1

7 PGS, ITR W/LER 78-43/01T-0 TO U.S. NRC, REGION I, AUG. 11, 1978,

DOCKET 50-334, TYPE--PWR, IFG--WEST., AE--STONE & WEBSTER

ACCESSION 140654

LIGHTNING STRIKE CAUSES LOSS OF TWO OFF SITE POWER SOURCES AT PRAIRIE

ISLAND 1

2 PGS, LTR W/LER 78-0 18/01T-0 TO NRC OFFICE OF I S E, REGION III,

SEPT. 26, 1978, DOCKET 50-282, TTPE--PWR, MFG--WEST., AE--PIONEER

SERV.
55

ACCESSION 149941

GROUND FAULT RESULTS IN LOSS OF 3 STATION POWER TRANSFORMERS AT SALEM

I

LTR W/LEP 79-038 TO U.S. NRC, REGION 1, MAY 15, 1979, DOCKET 50-272,

TYPE--PWR, MFG--WEST, AE--PSEG CONTROL--026008

ACCESSION 149947

SWITCHING ERROR CAUSE TRANSFORMER FAILURE AT PRAIRIE ISLAND 2

LTP W/LER 79-011 TO U.S. NRC, REGION 3, MAY 16, 1979, DOCKET 50-306,

TYPE--PWR, MFG--WEST, AE--PSE CONTROL--026015

ACCESSION 150927

EMERGENCY TRANSFORMERS HAVE DEGRADED INSULATION RESISTANCE AT BEAVER

VALLEY I

LTR W/LER 79-021 TO U.S. NRC, REGION 1, AUG 09, 1979, DOCKET 50-334,

TYPE--PWR, MFG--WEST, AE--S+W CONTROL--0 26482

ACCESSION 152187

STARTUP TRANSFORMER FAILS AND DIESEL GENERATOR FAILS TO START AT ST.

LUCIE I

LTR W/LER 79-028 TO U.S. NRC, REGION 2, SEP 17, 1979, DOCKET 50-335,

TYPE--PWR, MFG--COMB, AE-EBASCO CONTROL--027012

ACCESSION 152271

GROUND FAULT RESULT IN LOSS OF THREE STATION POWER TRANSFORMERS AT

SALEM 1

4 PGS, LTR W/RO 79-38/03L TO NRC OFFICE OF I & E, REGION I, MAY 15,

1979, DOCKET 50-272, TYPE--PWR, MFG--WEST., AE--PSE&G

ACCESSION 154894

RESERVE AUXILIARY TRANSFORMER FAILS AT KEWANNEE

LTR VILER 80-002 TO U.S. NRE, REGION 3, FEB 15, 1980, DOCKET 50-305,

TYPE--PWR, MFG--WEST, AE--PIONEER

ACCESSION 156027

ONE OFF-SITE POWER SOURCE TRIPS AT PEACH BOTTOM 2

LTR W/LEP 80-006 TO U.S. NRC, REGION 1, APE 3, 1980, DOCKET 50-277,

TYPE-B•W, MFG--GE, AE--BECH
56

ACCESSICN 164312

TWO SWITCHYARD BUSES TRIP AT DAVIS-BESSE 1

LTP W/LER 81-008 TO U.S. NRC, REGION 3, FEB 26, 1981, DOCKET 50-346,

TYP"--PWR, AFG--B&W, AE--BECH, DCS NO.--8103030826

ACCESSION 165907

EMERGENCY BUS TRANSFORMER FAILS AT NORTH ANNA I

LTR W/LER 8 1-020 TO U.S. NRC, REGION 2, APR 22, 1981, DOCKET 50-338,

TYPE--PWP, MFG--WEST, AE--S&W, DCS NO.--810422476

ACCESSION 165987

BUS FAILS TO ENERGIZE TWICE AT TURKEY POINT 4

LTR W/LER 81-004 TO U.S. NRC, REGION 2, APR 21, 1981, DOCKET 50-251,

TYPE--PWR, MFG--WEST, AE--BECH, DCS NO.--8105120415

ACCESSION 166020

OFF SITE POWER LOST AT GINNA

LTP W/LER 81-007 TO U.S. NRC, REGION 1, lAY 11, 1981, DOCKET 50-244,

TYPE--PWR, MFG--WEST, AE--GIL, DCS NO.--8105180305

ACCESSION 166069

OFF SITE POWER LINE TRIPS AT BROWNS FERRY I

LTR W/LER 81-013 TO U.S. NRC, REGION 2, MAY 19, 1981, DOCKET 50-259,

TYPE--BWR, MFG--GE, AE--TVA, DCS NO.--8105260468

ACCESSION 166852

SFUTDOWN TRANSFORMER BREAKERS OPEN AT PILGRIM I

LTR W/LER 81-024 TO U.S. NRC, REGION 1, JULY 3, 1981, DOCKET

50-293, TYPE--BWR, MFG--GE, AE--BECH, DCS NO.--8107130401

ACCESSION 167550

SPURIOUS SAFETY INJECTION ACTUATION AT NORTH ANNA 2

LTR W/LER 81-055 TO U.S. NRC, REGION 2, JUL 15, 1981, DOCKET

50-339, TYPE--PWR, MFG--WEST, AE--SSW, DCS NO.--8107280592

ACCESSION 167624

LIGHTNING STRIKE CAUSES LOSS OF ALL AC POWER AT CRYSTAL RIVER 3

LTP W/LER 81-033 TO U.S. NRC, REGION 2, JUL 14, 1981, DOCKET

50-302, TYPE--PWR, MFG--B&W, AE--GIL, DCS NO.--8107280585
57

ACCESSION 168664

OFF SITE POWER FEED TO EMERGENCY BUS LOST AT NORTH ANNA 2

LTP W/LEP 81-058 TO U.S. NRC, REGION 2, AUG 19, 1981, DOCKET

50-339, TYPE--PWR, MFG--WEST, AE--S&W, DCS NO.--8 108280182

ACCESSION 172348

OFF SITE POWER FAILS 1O AUTOMATICALLY SUPPLY ONSITE SYSTEM AT LACEOSSE

LTE W/LER 81-014 TO U.S. NBC, REGION 3, JAN 19, 1982, DOCKET 50-409,

TYPF--BWR, MFG--AC, AE--S%.L, DCS NO.--8202010254
58

CIRCUIT CLOSURES

ACCESSION 134620

DEFICIENCY IN STATIONARY ARCING CONTACTS OF CIRCUIT BREAKERS AT

SHOREHA4 1

2 PGS, LTR TO NRC OFFICE OF I & E, REGION I, DE:. 16, 1977, DOCKET

c0-322, TYPF--BWF, MFG--G.E., AE--STONE & WEBSTER

ACCESSION 136719

IE BULLETIN 78-05 4ALFUNCTIONING OF CIRCUIT BREAKER AUXILIARY CONTACT

MECHANISM-GENERAL ELECTRIC MODEL CR105X

6 PGS, LTR W/ENC. TO CINCINNATI GAS & ELECTRIC ZO., APRIL 14, 1973,

DOCKET r0-358, TYPE--BWR, MFG--GE, AE--SGT 5 LUNDY

ACCESSION 137043

DEFICIENT GE RELAYS ASSOCIATED 4160 VOLT CIRCUIT BREAKERS AT SHOREHAS

5 PGS, LTR W/ENC. TO NRC OFFICE OF I & E, REGION I, APRIL I, 1978,

DOCKET 50-322, TYPE--BWP, NFG--GE, AE--STONE & WEBSTER

ACCESSION 137355

DEFICIENCY IN GENERAL ELECTRIC TYPE NEC FUSE HOLDERS AT SHOREHAM

5 ?GS, LTF W/ATTACH. TO NRC OFFICE OF I & E, REGION I, hAY 1, 1978,

DOCKET 50-322, TYPE--BWR, MFG--GE, AE--STONE _ WEBSTER

ACCESSION 137356

DEFICIENCY WITH SNAP RINGS IN GE 4160 VOLT CIRCUIT BREAKERS AT

SHOREHAM

4 PGS, LTR W/ATTACH. TO NRC OFFICE OF I & E, REGION I, APRIL 28,

1978, DOCKET 50-322, TYPE--BWR, MFG--GF, AE--STONE & WEBSTER

ACCESSION 1461444

IE BULLETIN NO. 79-09 FAILURES OF GE TYPE AK-2 CIRCUIT BREAKER IN

SAFETY RELATED SYSTEMS

11 PGS, LrR W/ENC. TO JERSEY CENTRAL POWER & LIGHT CO., APRIL 17,

1979, DOCKET 50-219, TYPE--BWR, MFG--GE, AE--BURNS 6 ROE

ACCESSION 152971

REACTOR TRIP BREAKER FAILS TO OPEN AT ZION 2

LTR W/LER 79-049 TO U.S. NRC, REGION 3, NOV 08, 1979, DOCKET 50-304,

TYPE--PWR, MFG--WEST, AE--S4L CONTROL--027356
59

LIGHTNING

ACCESSION 125187

OUTSIDE POWER LOST AT INDIAN POINT 3

2 PPS, LTR W/RO 77-3-5(B) TO NRC OFFICE OF I & E, REGION I, JUNE 3,

1977, DJCKET 50-286, TYPE--PWR, MFG--WEST., AE--UE&C

ACCESSION 130111

BLACKOUT CONDITION OCCURS AFTER REACTOR TRIP AT COOK 1

4 PGS, LTR W/RO 50-315/77-30 TO NRC OFFICE OF I & E, REGION III,

SEPT. 28, 1977, DOCKET 50-315, TYPE--PWR, MFG--WEST., AE--UTILITY

ACCESSION 130119

A COMPLETE LOSS OF OFF-SITE POWER OCCURS AT PALISADES

3 PGS, LTE W/LER 77-047 TC NRC OFFICE OF I & E, REGION III, OCT. 18,

1977, DOCKET 50-255, TYPF--PWR, MFG--COMB., AE--BECHTEL

ACCESSION 135006

LOSS OF OFF SITE POWER OCCURS AT FARLEY 1

5 PGS, LTR W/LER 77-012/01T-0 TO NRC OFFICE OF I & E, REGION II,

SEPT. 29, 1977, DOCKET 50-348, TYPE--PWR, MFG--WEST., AE--BECHTEL &

SSI

ACCESSION 135785

100 FOOT SHIELDING MAST FALLS ACROSS 345 KV YARD BUS WORKS AT PILGRIM

I

5 PGS, LTR W/LER 78-002/01T-1 TO NRC OFFICE OF I & E, REGION I, FEB.

17, 1978, DOCKET 50-293, TYPE--BWR, MFG--G.E., AE--BECHTEL

ACCESSION 140140

LOSS OF ALL OFF SITE POWER SCRAMS THE REACTOR AT PILGRIM I

.2 PGS, LTR W/LER 78-035/01X-0 TO NRC OFFICE OF I & E, REGION I, AUG.

8, 1978, DOCKET 50-293, TYPE--BWR, MFG--GE, AE--BECHTEL

ACCESSION 140654

LIGHTNING STRIKE CAUSES LOSS OF TWO OFF SITE POWER SOURCES AT PRAIRIE

ISLAND 1

2 PGS, LTR W/LFR 78-018/01T-0 TO NRC OFFICE OF I & E, REGION III,

SEPT. 26, 1978, DOCKET 50-282, TYPE--PWR, MFG--WEST., AE--PIONEER

SERV.
60

ACCESSION 140871

LIGHTNING STRIKES CAUSE RFACrION TRIP AND SAFETY INJECTION AT PARLEY 1

6 PGS, LTR W/LEP 73-033/01T-0 TO NRC OFFICE OF I & E, REGION II, JUNE

20, 1978, DOCKET 50-348, TYPE--PWR, MFG--WEST., AE--BECHTEL & SSI

ACCESSION 150943

RPACTOR SCRAM FRO4 LOSS OF ALL OFF SITE POWER AT PILGRIM I

LTP W/LER 79-027 TO U.S. NRC, REGION 1, AUG 10, 1979, DOCKET 50-293,

TYP!--BWR, MFG--GE, AE--BECH CONTROL--026498

ACCESSION 151635

ALL OFF SITE POWER LOST AT PILGRIM 1

LTR W/LEP 79-033 TO U.S. NRC, REGION 1, SEP 11, 1979, DOCKET 50-293,

TYP.--BWR, nFG--GE, AE--BECH CONTROL--026781

ACCESSION 158228

ALL OFFSITE POWER LOSI AT PRAIRIE ISLAND 2

LTR W/LER 80-020 TO U.S. NRC, REGION 3, JUL 29, 1980, DOCKET 50-306,

TYPE--PWR, MFG--WEST, AF--PIONEER

ACCESSION 158232

OFFSITE POWER LOST AT INDIAN POINT 2

LTP W/LER 80-006 TO U.S. NRZ, REGION 1, JUN 17, 1980, DOCKET 50-247,

TYPF--PWP, MFG--WEST, AE--UE&C

ACCESSION 159238

OFFSITE POWER LOST AT INDIAN POINT 3

LTP W/LER 80-008 TO U.S. NRC, REGION 1, JUL 2, 1980, DOCKET 50-286,

TYPE--PWP, MFG--WEST, AE--tE&C

ACCESSION 159267

OFF SITE ELECTRIC POWER LINE TRIPS AT BROWNS FERRY I

LTR W/LER 90-359 TO U.S. NRC, REGION 2, SEP 4, 1980, DOCKET 50-259,

TYPE--BWR, MFG--GF, AP--'tVA

ACCESSION 159553

SAFETY INJECTION ACTUATES AT SALEM I

LTE V/LER 80-031 TO U.S. NRC, REGION 1, JUL 8, 1980, DOCKET 50-272,

TYPE--PWR, MFG--WEST, AE--PSE&G
61

ACCESSION 164312

TWO SWITCHYARD BUSES TRIP AT DAVIS-BESSE 1

LTP W/LER 81-008 TO U.S. NRC, REGICN 3, FEB 26, 1981, DOCKET 50-346,

TYPv!--PWR, MFG--B&W, AF--BECH, DCS NO.--8103030826

ACCESSION 167624

LIGHTNING STRIKE CAUSES LOSS OF ALL AC POWER AT CRYSTAL RIVER 3

LTR W/LER 81-033 TO U.S. NRC, REGION 2, JUL 14, 1981, DOCKET

50-302, TYPE--PWP, MFG--BFW, AE--GIL, DCS NO.--8107280585

ACCESSION 170051

69KV ALTERNATE SOURCE LOST WHEN JUMPER FAILS AT COOK I

LTR W/LER 81-049 TO U.S. NRC, REGION 3, OCT 30, 1981, DOCKET

50-315, TYPE--PWR, MFG--WEST, AE--UTILITY, DCS NO.--8111090695
62

CONTROL PANELS

ACCESSION 125196

MG6 RWLAYS FOUND WITH INTERNAL SHORT CIRCUITS AT SEQUOYAH 1 & 2

3 PPS, LTR W/REPORT TO NRC OFFICE OF I & E, REGION II, MARCH 31,

1977, DOCKETS 50-327/328, rYPE--PWR, MFG--WEST., AE--TYA

ACCESSION 125203

SHORT CIRCUIT IN RELAY CAUSES FIRE IN CONTROL PANEL AT PEACH BOTTOM 3

5 PPS, LTR W/RO 3-77-14/IT TO NRC OFFICE OF I & E, REGION I, MAY 2,

1977, DOCKET 50-278, TYPE--BWR, MFG--G.E., AE--BECHTEL

ACCESSION 142297

CARRIAGE BOLTS USED ON 480V MCC BUS SPLICES FAIL AT SUSQUEHANNA I & 2

9 PGS, LTP W/ATT&CH. TO U.S. NRC, REGION I, SEPT. 18, 1978., DOCKETS

50-387/388, TYPE--B$IR, MFG--GE, AE--BECHTEL

ACCESSION 171041

FIPE DROTECTION ALAPM PANEL FAILS AT PALISADES

LTR W/LFR 81-046 TO U.S. NRC, REGION 1, NOV 19, 1981, DOCKET 50-255,

TYPE--PWR, NFG--COMB, AR--BECH, DCS NO.--8111300446
63

CABLES AND CONNECTORS

ACCESSION 123040

ELECTRICAL FAULT TRIPS BUS IC AT OYSTER CREEK

5 PGS, LTR W/RO 50-219/77-4-IT TO NRC OFFICE OF I S E, REGION I,

MARCH 30, 1977, DOCKET 50-219, TYPE--BWR, MFG--G.E., AE--BURNS & ROE

ACCESSION 125124

4160/480 VOLT TRANSFORMER FAILS AT FT. CALHOUN 1

5 PPS, LTR W/LER 50-285/77-13 TO U.S. NRC, REGION IV, MAY 12, 1977,

DOCKET 50-285, TYPE--PWR, MFG--COMB., AE--GIBBS & HILL

ACCESSION 126484

DEFICIENCY FOIND IN STATIONARY DISCONNECT OF 4160 V SWITCHGEAR AT

SHOR EHAM

2 PGS, LTR TO NRC OFFICE OF I & E, REGION I, JUNE 6, 1977, DOCKET

50-322, TYPE--BWR, MFG--G.E., AE--STONE & WEBSTER

ACCESSION 130119

A COMPLETE LOSS OF OFF-SITE POWER OCCURS AT PALISADES

3 PGS, LTR W/LER 77-047 TO NRC OFFICE OF I & E, REGION III, OCT. 18,

1977, DOCKET 50-255, TYPE--PWR, MFG--COMB., AE--BECHTEL

ACCESSION 137355

DEFICIENCY IN GENERAL ELECTRIC TYPE NEC FUSE HOLDERS AT SHOREHAM

5 PGS,-LTR V/ATTACH. TO NRC OFFICE OF I & E, REGION I, MAY 1, 1978,

DOCKET 50-322, TYPE--BWR, MFG--GE, AE--STON! & WEBSTER

ACCESSION 139825

A HOLE FOUND IN CABLE SHEATH FOR ONE PHASE OF CAR FAN MOTOR AT

CONNECTICUT YANKEE

2 P3S, LTR W/RL 78-13/3L TO NRC OFFICE OF I & E, REGION I, JULY 5,

1978, DOCKET 50-213, TYPE--PWR, MFG--WEST., AE--STONE & WEBSTER

ACCESSION 140132

ARCING FAULTS FOUND IN MOTOR CONTROL CENTERS AT HATCH 2

3 PGS, LTR W/ATTACH. TO NRC OFFICE OF I 5 E, REGION II, MAY 17, 1978,

DOCKET 50-366, TYPE--BWR, MFG--GE, AE--SSI & BECHTEL

ACCESSION 140140

LOSS OF ALL OFF SITE POWER SCRAMS THE REACTOR AT PILGRIM 1

2 PGS, LTR W/LER 78-035/O1X-0 TO NRC OFFICE OF I & E, REGION I, AUG.

8, 1978, DO-_KET 50-293, TYPE-BWR, MFG--GE, AE--BECHTEL
64

ACCESSION 148770

OFF SITE POWER LOST WHEN JUMPEP CABLE BURNED OFF AT COOK I

LTP W/LER 79-026 TO U.S. NRC, REGION 3, MAY 02, 1979, DOCKET 50-315,

TYPE--PWR, MFG--WEST, AE--AEP CONTPOL--025580

ACCESSION 149180

IMPROPER ROUTED POWEP AND CONTROL CABLES AT PEACH BOTTOM 2

LTR W/LER 79-010 TO U.S. NRC, REGION 1, MAR 12,,1979, DOCKET 50-277,

TYPE--BWP, rFG--GE, AE--BEZH CONTROL--025316

ACCESSION 149321

POTENTIAL OVERLOAD CONDITION FOUND ON STATION TRANSFER BUSES AT NORTH

ANNA I

LTP W/LFR 79-057 TO U.S. NRC, REGION 2, MAY 04, 1979, DOCKET 50-338,

TYPE--PWR, MFG--WEST, AE--S+W CONTROL--025749

ACCESSION 149941

GROUND FAULT RESULTS IN LOSS OF 3 STATION POWER TRANSFORMERS AT SALEM

1

LTP W/LER 79-038 TO U.S. NRC, REGION 1, MAY 15, 1979, DOCKET 50-272,

TYPE--PWR, MFG--WEST, AE--PSEG CONTROL--026008

ACCESSION 150285

INSULATION CRACKS FOUND IN BUS SLEEVING AT CRYSTAL RIVER 3

LTP W/LER 79-054 TO U.S. NRC, REGION 2, JUN 15, 1979, DOCKET 50-302,

TYPE--PWR, MFG--B+W, AE--GIL CONTROL--026209

ACCESSION 152271

GROUND FAULT RESULT IN LOSS OF THREE STATION POWER TRANSFORMERS AT

SALEM 1

4 PGS, LTR W/RO 79-38/03L TO NRC OFFICE OF I & E, REGION I, MAY 15,

1979, DOCKET 50-272, TYPE--PWR, MFG--WEST., AE--PSESG

ACCESSION 153603

CRACKING NOISE HEARD COMING FROM BREAKER OUTPUT CABLE AT NORTH ANNA 1

LTR W/LER 79-136 TO U.S. NRC, REGION 2, NOV 01, 1979, DOCKET 50-338,

TYPE--PWR, MFG--WEST, AE--S+W CONTROL--027601

ACCESSION 153801

CABLES DAMAGED WHEN PULLED THROUGH CONDUITS AT SUSQUEHANNA I

LTR W/LER - TO U.S. NRC, REGION 1, JUL 17, 1979, DOCKET 50-387,

TYPE--BWR, MFG--GE, AE--BE'H CONTROL--027731
65

ACCESSION 154453

NEUTRAL LEADS FROM DG TO TRANSFORHER CUT AS CONNECTICUT YANKEE

3 PGS, LTR W/LEP 80-02/3L TO NRC OFFICE OF I & E, REGION I, JAN. 18,

1980, DOCKET 50-213, TYPE--PWR, MFG--WEST, AE--SFW

ACCESSION 1554 13

OFF-SITE POWER SOURCE LOST AT SALEM I

LTP W/LER 80-014 TO U.S. NRC, REGION 1, MAR 31, 1980, DOCKET 50-272,

TYPE--PWR, MFG--WEST, AF--PSE&G

ACCESSION 156960

FEEDER BUS FAULT TRIPS RECIRCULATION PUMP AT BROWNS FERRY I

LTR W/LER 80-331 TO U.S. NRC, REGION 2, MAY 14, 1980, DOCKET 50-259,

TYPE--BWR, MFG--GE, AE--TVA

ACCESSION 158232

OFFSITE POWER LOST AT INDIAN POINT 2

LTP W/LER 80-006 TO U.S. NRZ, REGION I, JUN 17, 1980, DOCKET 50-247,

TYPE--PWR, MFG--WEST, AE--UEFC

ACCESSION 159238

OFFSITE POWER LOST AT INDIAN POINT 3

LTR W/LER 80-008 TO U.S. NBC, REGION 1, JUL 2, 1980, DOCKET 50-286,

TYPE--PVR, MFG--'JEST, AE--UE&C

ACCESSION 160554

ELECTRIC POWER DISRUPTED AT SUPRY 2

LTR W/LER 80-035 TO U.S. NR:, REGION 2, NOV 13, 1980, DOCKET 50-281,

TYPF--PWR, MFG--WEST, AE--S&W

ACCESSION 1643 10

UPDATE ON LOSS OF ONE OFF SITE POWER SOURCE AT "ALVERT CLIFFS 1

LTR V/LER 80-043R TO U.S. NRC, REGION 1, FEB 23, 1981, DOCKET 50-317,

TYPE--PWR, MFG--COMB, AE--BECH, DCS NO.--8103040654

ACCESSION 165482

ESF VENTILATION TRAIN INOPERABLE FOR VALVE POWER CABLE WORK AT COOK I

LTR V/LER 81-306 TO U.S. NRC, REGION 3, APR 9, 1981, DOCKET 50-315,

TYPE--PWR, MFG--WEST, AE--UTILITY, DCS NO.--8104160370
66

ACCESSION 166069

OFF SITE POWER LINE TRIPS AT BROWNS FERRY 1

LTR W/LER 81-013 TO U.S. NRC, REGION 2, .AY 19, 1981, DOCKET 50-259,

TYPE--BWR, MFG--GR, A!--TVA, DCS NO.--8105260468

ACCESSION 166070

OFF SITE POWER LINE TRIPS AT BROWNS FERRY 1

LTR W/LER 81-012 TO U.S. NEC, REGION 2, MAY 19, 1981, DOCKET 50-259,

TYPE--BWR, 11FG--GE, AE--TVA, DCS NO.--8105260475

ACCESSION 166479

OFF SITE 115KV SUPPLY BREAKER TRIPS AT FITZPATRIZK

LTP W/LPR 81-042 TO U.S. NRC, REGION 1, JUN 11, 1981, DOCKET

50-333, TYPE--BWR, MFG--GE, AE--S-W, DCS NO.--810617007

ACCESSION 170051

69KV ALTERNATE SOURCE LOST WHEN JUMPER FAILS AT COOK 1

LTR W/LER 81-049 TO U.S. NRC, REGION 3, OCT 30, 1981, DOCKET

50-315, TYPE--PWR, MFG--WEST, AE--UTILITY, DCS 110.--8111090695

ACCESSION 172660

RESERVE STATION SERVICE TRANSFORMER LOST AT SURRY 2

LTR W/LER 82-008 TO U.S. NRC, REGION 2, FEB 17, 1982, DOCKET 50-281,

TYPE--PWR, MFG--WEST, AE--SfW, DCS NO.--8203080222

ACCESSION 172713

UPDATE ON SHUTDOWN DUE TO L03S VITAL AC AT COOK 2

LTR W/LER 81-027 REV I TO U.S. NRC, REGION 3, MAR 17, 1982, DOCKET

50-316, TYPE--PWR, MFG--WEST, AE--UTILITY, DCS NO.--8203260260
67

OTH!RWISE SIGNIFICANT

ACCESSION 129293

CABLE FIRES IN POWER STATIONS

4 PPS, 5 FIGS, ELECTRONICS & POWER, 23(2), PP. 148-51 (FEB. 1977)

ACCESSION 131157

HUMAN FACTORS REVIEW OF NUCLEAR POWER PLANT CONTROL ROOM DESIGN.

FINAL REPORT

EPRI-NP-309(FINAL REPORT) 4. 375 PPS, TABS, FIGS, REFS, MARCH 1977

ACCESSION 143495

600 VAC INTRODUCED INTO 115 TAC REFUELING INTERLOCK CIRCUIT AT

FITZPATRICK

3 PGS, LTR W/LER 77-43 TC U.S. NRC, REGION I, AUG. 1 1, 1977, DOCKET

50-333, TYPE--BWR, MFG--GE, AE--STCNE & WEBSTER

ACCESSION 152844

CABLE LENDS TO EMERGENCY FEEDWATER VALVES WERE LIFTED AT ARKANSAS

NUCLEAR 1

2 PGS, LTR W/LER 79-NA/99X-0 TO NRC OFFICE OF I & E, REGION IV, AUG.

1, 1979, DO:KET 50-313, TYPE-PWR, MFG--BSW, AE--BECHTEL

ACCESSION 154694

A FIRE IN SOME ELECTRICAL RACEWAYS COULD EFFECT REDUNDANT TRAINS AT

PILGRIM 1

3 PGS, LTR W/LER 80-001/01T-0 TO NRC OFFICE OF I 9 E, REGION I, FEB.

1, 1980, DOCKET 50-293, TYPE--BWR, MFG--GE, AE--BECH

ACCESSION 161016

HUMAN FACTORS METHODS FOR NUCLEAR CONTROL ROOM DESIGN VOLUME 4:

HUMAN FACTORS CONSIDEPATIONS FOR ADVANCED CONTROL BOARD DESIGN

EPRI-NP-1118(VOL.lI) +. 115 PPS, FIGS, MARCH 1980

ACCESSION 161704

OUT OF PHASE POWER TRANSFER POSSIBLE AT NORTH ANNA I AND 2

LTR W/LER 80-096 TO U.S. NRC, REGION 2, NOV 21, 1980, DOCKET 50-338,

TYPE--PWR, MFG--WEST, AE--S&W, DCS NO.--8012010363

ACCESSION 163959

SUMMARY OF RESULTS OF NRC HUMAN ENGINEERING AUDIT OF NORTH ANNA 2

CONTROL ROOM

5 PGS, LTR W/ENC. TO VIRGINIA ELECTRIC & POWER CO., APR. 11, 1980,

DOCKET 50-339, TYPE--PWF, MFG--WEST, AE--S&W, DCS NO.--8004250031
68

ACCESSION 164909

FUMAN FACTOR SESSION

22 PPS, PP. 150 THPU 171 OF TRANS. OF THE AMERICAN NUCLEAR SOCIETY,

VOL. 35, FROM 1980 WINTER MEETING; WASHINGTON, D.C., NOV. 16-21,

1980

ACCESSION 166009

APPLIED HUMAN ENGINEEPING TO IMPROVE THE MAN-PROCESS INTERACTION IN A

NUCLEAR POWER PLANT

13 PPS, IEEE TRANS. NUCL. SCI., 28(1), PP. 955-67 (FEB. 1981)

ACCESSION 171493

HUMAN FACTORS IN T9E CONTRCL ROOM

8 PPS, ANS TRANSACTIONS, VOL. 39, PP. 278-85, FROM 1981 WINTER

MEETING; SAN ?PANCISCO, CA, NOV. 29-DEC. 3, 1981
69

Appendix B

GIDEP SYSTEMS

Alert System

The ALERT system provides the GIDEP participants with wide, early,

and rapid notification of actual and potential problems and failure trends

on parts, components, materials, manufacturing processes, test equipment,

or significant safety (SAFE-ALERT) problems of general concern. This is

accomplished by ALERT and SAFE-ALERT reports. The ALERT data constitutes

a large portion of the computerized Failure Experience Data Bank (FEDB).

Scope

The ALERT system is utilized by participating agencies to provide a

rapid closed-loop interchange between the GIDEP participants and the product manufacturer.

General

The timely submittal of data from the GIDEP participants to the GIDEP

Operations Center is essential. Timely submittal allows rapid dissemination of data to all participants.

Participants are required to be a member of the Failure Experience

Data Interchange in order to receive ALERTS.

ALERT/SAFE-ALERT reports are submitted on an approved ALERT Form (DD

Form 1938) which has been cleared for joint contractor and Government use.

ALERT and SAFE-ALERT Requirements

The GIDEP participant initiates an ALERT for certain situations involving a problem of general concern pertaining to parts, materials, or

manufacturing processes, or a SAFE-ALERT pertaining to a "safety" problem.

The ALERT is intended to define an actual or potential problem/

failure of a common or generic part, component, material, or process.

ALERTs will not be prepared to report a random failure of a part, component, material, or process.

The problem must be clearly, concisely, and objectively described,

stating the exact conditions and circumstances surrounding the problem, as

well as the failure mode, causes and corrective actions, if known. The

ALERT must stand alone for interpretation since participants receiving the

ALERT will not have the background information available to the originator.

Copies of all necessary supporting documentation shall be submitted

with the ALERT including any affected manufacturer's comments and a copy

of the transmittal letter that forwarded the proposed ALERT to the manufacturer for coordination.
70

A copy of the ALERT shall be submitted to the manufacturer. The manufacturer must be provided an opportunity to review, comment, and/or present corrective action on the problem identified in the ALERT prior to

distribution through GIDEP. The coordinating time has been established as

a minimum of 15 working days.

Due to criticality and possible injury to personnel, SAFE-ALERTs

should be submitted concurrently and coordinated with the manufacturer

simultaneously with submittal to the GIDEP Operations Center.

The recommended method for transmittal of the ALERT to the manufacturer is by "Certified Mail," with return receipt requested.

GIDEP Representative Responsibilities

a. Develop a program to ensure that all problems at his facility which

constitute the basis for a potential ALERT are reported to him.

b. Ensure that the manufacturer's comments are solicited to give the

recipients a complete picture of the problem.

c. Define the problem as specifically as possible.

d. Include all backup data.

GIDEP Representative Responsibilities (ALERT Recipient)

a. Screen ALERT for applicability and distribute.

b. Provide all additional and pertinent experience information immediately to the originator and to the GIDEP Operations Center.

c. Report to the GIDEP Operations Center follow-up information or corrective actions that result from the ALERT and would be of interest

to the ALERT originator or other Representatives.

ALERT Processina and Distribution

a. To distinguish between the ALERT and the SAFE-ALERT, the ALERTs are

reproduced on light red (pink) paper, and the SAFE-ALERTs are reproduced on green paper.

b. All ALERTs are abstracted and key-entered into the computer at the

GIDEP Operations Center.

c. The GIDEP Operations Center issues monthly and cumulative indexes of

all ALERTs to GIDEP participants.

GIDEP representatives

Participant-to-participant communication is effective by use of the

Roster of Representatives.
71

Reliability-Maintainability Data Interchange

Introduction

This section describes the operating procedures for the ReliabilityMaintainability Data Interchange portion of the Government-Industry Data

Exchange Program.

scope

The Reliability-Maintainability Data Interchange was established to

provide an interchange of reliability and maintainability data on parts,

components, assemblies, equipments, subsystems and systems based on field

performance information and reliability/maintainability demonstration

tests on operational systems and equipments.

General

Participants submit data to the Reliability-Maintainability Data Bank

(RMDB).

Government and Contractor Organizations developing or monitoring

hardware systems and equipment submit failure rate, failure mode, replacement rate, and mean repair time data on parts, components, assemblies,

equipment, subsystems and systems.

Manufacturers

Reliability-Maintainability data may be submitted by manufacturers of

parts, components, assemblies, equipment, subsystems and systems provided

the supporting test data are included and the data meet requirements for

Manufacturer Test Data.

Data Dissemination and Retrieval

The GIDEP Operations Center reviews, compiles, and summarizes the

Reliability-Maintainability Data received from a GIDEP participant and

distributes these data to other participants by the following media:

Microfilm

Printed summaries

Remote computer terminal

Technical document file.

Urgent Data Request System

The Urgent Data Request System allows any participant to query all

other participants to solve problems on specific parts, components, materials, processes, or to request other critical information not available

from other sources.

The ALERT system

Participant-to-participant communication.

73

Appendix C

BIBLIOGRAPHY

Design Bases for Class 1E Power Systems.

IEEE-Std. 308-1974, "Criteria for Class 1E Power Systems for Nuclear Power

Generating Stations."

IEEE-Std. 317-1976, "Electric Penetration Assemblies in Containment Structures for Nuclear Power Generating Stations."

IEEE-Std. 323-1974, "Qualifying Class lE Equipment for Nuclear Power Generating Stations."

IEEE-Std. 336-80, "Installation, Inspection, and Testing Requirements for

Class 1E Instrumentation and Electric Equipment at Nuclear Power

Generating Stations. NRC Adapted."

IEEE-Std. 338-1975, "Criteria for Periodic Testing of Nuclear Power Generating Station Class 1E Power and Protective System."

IEEE-Std. 379-1977, "Guide for the Application of the Single-Failure Criterion to Nuclear Power Generating Station Class 1E System."

IEEE-Std. 383-1974, "Type Test of Class 1E Electric Cables, Field Splices

and Connections for Nuclear Power Generating Stations."

IEEE-Std. 384-1977, "Criteria for Independence of Class 1E Equipment and

Circuits."

IEEE-Std. 420-1973, "Trial-Use Guide for Class 1E Control Switchboards for

Nuclear Power Generating Stations."

Title 10, Code of Federal Regulations, Part 50, Appendix A.

Regulatory Guide 1.6, "Independence between Redundant Standby (onsite)

Power Sources and Between their Distribution Systems."

Regulatory Guide 1.53, "Application of the Single-Failure Criterion to

Nuclear Power Plant Protection Systems."

Regulatory Guide 1.89, "Qualification of Class 1E Equipment for Nuclear

Power Plants."

Regulatory Guide 1.131, "Qualification Tests of Electric Cables, Field

Splices, and Connections for Light-Water-Cooled Nuclear Power

Plant s. "
74

General Standards and/or Codes

ANSI C37.010, 1972, "Application Guide for AC High-Voltage Circuit Breaker

Rated on Symmetrical Current Bases."

ANSI C37.20, 1974, "Switchgear Assemblies Including Metal Enclosed Bus"

and Supplement.

IPCEA*-NEMA P-54-440 2nd Ed., 1975, "Ampacities of Cables in Open-Top

Cable Trays."

IPCEA P-46-426, 1962, "Power Cable Ampacities."

General Bibliography

"Burn Mode Analyses of Horizontal Cable Tray Fires," W. H. Schmidt and

F. R. Krause, NUREG/CR-2341, SAND81-0079.

"Cable Fires in Power Stations," T. M. White and A. R. Sutton, Electronics

and Power PP148-51, February 1977.

"Fire Protection for Nuclear Power Plants from the Insurance Industries

Viewpoint," 1. J. Carney, ANS Winter Meeting, San Francisco, November

1977.

"Occurrence Rates of Fires in Nuclear Power Plants," W. E. Vesely, D. J.

Parker, M. L. Yeates, USNRC- Rensselaer Polytechnic Institute, Nuclear Engineering and Design, pp. 233-40, August 1981.

"Power Transformer Fire Protection," D. R. Worley, WATIEC '80 Energy Conference, Pennsylvania Power and Light Company.

"Wanted - A Substitute for Askarel," D. A. Duckett, Electric Light and

Power, 1975, pp. 9-13.

*Insulated Power Cable Engineers Association, ANSI C62.2 - 1969,

"Guide for Application of Valve-Type Lightning Arrestors for Alternating

Current Systems."
75

Appendix D

SAMPLE FAILURE REPORTS

To the Files

_ Power Plant Maintenance Supervisor, Electrical

May 15, 1968

500-KV TRANSFORMER, SERIAL NO.

On May 6, 1968, at 4:28 a.m., a high- or low-gas pressure alarm on No. 5

transformer bank was recorded. At 7:30 a.m. the shift engineer passed

this information along verbally to _, Assistant Electrical Maintenance Supervisor. made out a maintenance report and had

electricians assigned to the job. The first step was to find which transformer had the high- or low-gas annunciation on it. There are two contacts on each of the four transformers in parallel and all are common to

one annunciator point. The annunciation was found to be on spare transformer which was being used on AO at this time.

Mr. erecting engineer, was on the job erecting AO transformer. He was contacted and told about the high-gas pressure alarm.

While the electricians were gone to get the Johnson & Williams combustible

gas analyzer Mr. _ opened the sampling valve and used a cigarette

lighter to determine if the gas was combustible. The gas proved to be

highly combustible, and when ignited it set fire to the plasic hose that

was being used on the valve. The transformer was checked and an arcing

noise was heard in the high side bushing well. The transformer was taken

out of service immediately.

Mr. - contacted his company and they decided that the arc was corona

at the bottom end of high side bushing between the conductor or live part

of bushing to the shielding body called a "torrid" by _ . The 500-kV

bushing was removed from the bushing well. The shielding body had been

shaken loose or had vibrated loose from its attachment on the conductor

just below where the conductor entered the bushing. The shielding body

showed some signs that the bushing well in which it was installed had some

very hard blows during shipment. One of the three aluminum fingers which

attach the shielding body to the bushing conductor had a 90 degree bend in

it. This bent finger had no signs of arcing on it but the other two

fingers showed signs of considerable arcing on the ends of each where they

had been loose between the attachments on the bushing conductor. This no

doubt, was causing the combustible gas to form in the transformer.

Mr. design engineer, arrived on the job May 7, 1968. He

made several calls to _ regarding how to correct the trouble on the

transformer. He suggested to the factory that the complete bushing well
76

2

To the Files

May 15, 1968

500-KV - TRANSFORMER, SERIAL NO.

assembly from A phase be installed on the spare, but the factory said that

the bushing wells were not interchangeable. They told Mr. _ to

remove the shielding body from A phase bushing well and install it in

place of the bad one on the spare. Someone decided to pull the complete

bushing well of the spare transformer and take it to the turbine room for

repairs. The oil was pumped out of the transformer and the transformer

filled with nitrogen as the oil was pumped down to below the bushing well

boss. The bushing well was removed and taken to the turbine room where it

was partially disassembled.

An attempt was made to install the shielding body in the insulating tube

without complete disassembly but they found this could not be done, so the

bushing housing was completely disassembled and all the insulation removed

from it. The shielding body was installed in the insulator tube and tied

off, and the insulation was retied with cotton and linen tape and reinstalled in bushing well. The bushing well was reassembled and each end

closed up. Electric heaters (4 each 4 kW) were installed in one end of

bushing well and the temperature raised to 90 degrees F for approximately

six hours on May 10, 1968. A vacuum was pulled on bushing well after noon

on May 10, 1968, and left until 7:00 a.m., May 11, 1968.

The bushing well was installed on the spare transformer May 11, 1968. The

transformer was purged with nitrogen during the installation of the bushing well and bushing. The bushing was also installed about noon May 11,

during a rain shower.

During the time the spare transformer bushing was being repaired with

parts from A phase the shielding body removed from the spare was repaired.

Crepe paper was flown in from __ , also some cotton tape, and the

shielding body was reinsulated with the crepe paper to a thickness of 50

millimeters, (about two inches) or enough for 2 million volts. The

shielding body was placed in the electric shop drying oven at a temperature of 212 degrees F and left for 24 hours. After this it was installed

in the insulator tube, and the bushing well and insulation reassembled.

After being reassembled it was heated and a vacuum pulled on it same as

the other bushing well.
77

TO:

FROM: , Power Plant Maintenance Supervisor, Electrical

DATE: June 4, 1970

SUBJECT: POWER CIRCUIT BREAKER 5224

On June 3, 1970, at 10:01 a.m. breaker 5224 was opened by operator to deenergize the ___. At 10:02 a.m. on this date the

motor-operated switches 5223 and 5225 were opened to isolate breaker 5224.

At 10:30 a.m. on this date the operator received an air pressure abnormal

annunciation on breaker 5224. At 10:42 a.m. the switchboard operator received a telephone call from Mr. __ , electrician foreman for Power

Construction, who was working in the switchyard, that breaker 5224 had

blown up.

The writer received a call for shift engineer at approximately 10:45 a.m. about the trouble on 5224 breaker.

An immediate investigation was begun to try and determine what damage was

done and what caused it.

We found that on A phase head number 4, the tripping resistor assembly had

blown completely off the breaker and was scattered over a wide area of the

switchyard.

When the resistor assembly blew parts of it were blown into the capacitor

on the respective head and had damaged the capacitor; also considerable

damage was done to the main chamber porcelain by flying parts. Further

investigation revealed that the guy insulator on pole # 4 had several

broken skirts on it.

The writer contacted with Electrical Maintenance in

and explained to him what had happened and asked him to contact

the manufacturer of the breaker and find out if these resistors, which

have been known to cause trouble for some time on other breakers like

this, had caused this type of trouble before.

_ called back later and said that Mr. _ and Mr. __ , both

representatives, would be at - on the morning of June 4,

1970, and that they would like for us to leave the breaker as it is until

they could inspect it.

As for the cause of the trouble it is my opinion that the resistor was

broken off of its mechanical support but was still connected electrically

and when the breaker was opened the resistor contact closed as it should

but never opened as it should, thus letting current pass through the resistor and through the capacitors on the other three heads until the disconnect switches were opened.
78

POWER CIRCUIT BREAKER 5224

After the disconnect switches were opened the capacitor on the respective

head was discharged through the resistor. The current passing through the

resistor caused a tremendous amount of heat to be generated inside the

resistor chamber which is filled with air at 365 psi. The heat caused the

air to expand until the pressure built up beyond the bursting pressure of

the porcelain resistor chamber so it exploded.

As has been stated before, on this type of breaker the tripping resistor

supports have been known to break off. We have known for several months

that these resistors were to be removed from the breaker and the holes

blanked off with a special cover to be furnished by _ . The latest

correspondence from -- on this matter was that the blank covers would

be furnished to _ in July 1970.
79

TO: , Steam-Electric Generation Branch, 905 EB-C

FROM: , Power Plant Superintendent,

DATE: March 13, 1973

SUBJECT: 1H UNIT STATION SERVICE TRANSFORMER INTERNAL EXPLOSION -

On February 17, 1973, at 12:51 p.m. operating time, the lH unit station

service transformer was severely damaged by an internal explosion. This

transformer was built by _ _. It is a type TCR, 13,500 kVA S.C./

18,000 kVA F.A., 22,500 volts delta to 6,900-V wye, serial No. 2056225.

Following is a list of events that occurred when the transformer went into

trouble. The events are listed in the order that they were printed out on

the electrical control room Lundell sequential annunciator recorder although this does not mean that they necessarily happened in this order.

12:51-14

12:51-14

12:51-14

12:51-14

12:51-14 99I

99t

# 9

.9I

9.o

9,t

99e

9,

# 9

99 l

9.J

99 l

'9 l

9, l

lH U.S.S. transformer high temperature -

2 Cy. Of' ' t' low oil level

4 Cy.

4lCy

991

.9e

99 I

.9l

9, l

99l

.9l

99l

.9 l

l9,

Turbine shut d

1H U.S.S. tran 99l 99

99f 99l

99l 99l

own

sformer high temperaturerelay operation -

low oil level -

high or low gas

pressure -

OCB 878 open -

OCB 874 11

lH transformer sprinkler system on -

ýOf ' differential or sudden

pressure relay operation -

1H U.S.S. high or low gas pressure -

Generator backup relay operation -

250-Volt d.c. or 480-V d.c. ground -

1H U.S.S. transformer high or low gas

pressure -

99 99 f 9 #9 99 99

250-Volt d.c. or 48-volt d.c. ground -

1H U.S.S. transformer relay operation -

t'o or o high or low gas

abnormal

normal

abnormal

normal

abnormal

abnormal to

abnormal

o,

normal

abnormal

abnormal

abnormal

abnormal

normal

normal

abnormal

normal

abnormal

normal

pressure -

7 Cy. 1H U.S.S. transformer high or low gas

pressure -

Unit 6.9 kV board transfer -

Oscillograph operation -
80

2

March 13, 1973

1H UNIT STATION SERVICE TRANSFORMER INTERNAL EXPLOSION -

12:51-14 7 Cy. 1H generator overcurrent relay operation - abnormal

to so 1H generator neutral overvoltage relay

operation - normal

This Lundell recorder has been fairly reliable in the past with the exception that it will give erroneous annunciations at times when switching is

being performed in the station or when grounds occur on the annunciation

system. There are at least two points that were missed on the above list.

One is the oscillograph annunciation that was not printed abnormal and the

other was 1H generator neutral overvoltage relay abnormal annunciation.

We have no reason to doubt that what annunciations that were recorded are

correct. There is a very good possibility that these are not recorded in

the sequence as they actually happened due to some things such as the

transformer high temperature and low oil level coming in directly off a

switch and not having to come through a relay. Also, there are others

such as the turbine shutdown annunciation that are relayed by a much faster operating relay than the transformer relay operation annunciation.

The Lundell sequential annunciator recorder in the unit control room

recorded the following events:

12:51-24 Power available 1H auxiliary oil pump - abnormal

:t a.c. turning gear oil pump - abnormal

12:51-24 3 Cy. ' 1H auxiliary oil pump - normal

t 5 Cy. Power available 1H auxiliary oil pump - abnormal

It 7 Cy. Turbine tripped electrical trouble - abnormal

of of Power available 1H auxiliary oil pump - normal

to 10 Cy. Generator oil circuit breakers open - abnormal

The above listed annunciations are most likely in the sequence as they

actually happened and are correct annunciations. The unit control room

system was ten seconds faster than the electrical control system when

checked after the fault. There is no possible way of comparing the two

annunciator system annunciations to tell which may have occurred first

since the same annunciations, such as oil circuit breakers open, are actuated from different switches and relays.

We are confident that we lost the voltage on the 1H 480-volt unit board at

14 seconds after 12:51 p.m. when the power available - lH auxiliary oil

pump abnormal annunciation was received in the unit control room since the
81

3

March 13, 1973

1H UNIT STATION SERVICE TRANSFORMER INTERNAL EXPLOSION -

relay that gives this annunciation is connected across the 1H 480-volt

board bus potential transformers. Also, the power available a.c. turning

gear oil pump abnormal anunciation was received in the same cycle; this

relay also is fed from the 1H unit board bus.

The following protective relays had targets on them as recorded by the

electrical operator:

1. lH main transformer differential A, B, and C phase

2. lH unit transformer overcurrent A and B phase

3. lH unit station service differential A phase

4. 1H generator overcurrent A and B phase

5. lH generator backup impedance

6. iL generator overcurrent A, B, and C phase

We know by the annunciations that were recorded that other auxiliary relays such as the neutral voltage auxiliary relay and possibly the sudden

pressure relay operated but apparently did not knock the target down.

At some point shortly before or during the fault on the transformer, 1B5

pulverizer was tripped by overcurrent relay. This was caused by a phaseto-phase fault behind the lH 6,900-volt unit board where the pulverizer

motor leads tie to the bus. A welding rod was found laying across B phase

bus. There was slight damage to the bus on all three phases (see attached

photo No. 1) and some damage top the tape on the bus for approximately 18

inches above the fault. It is very possible that the primary of the

transformer shorted to the secondary and the 24-kV got back on the 6.9-kV

bus about the time the feeder breakers were opened and the welding rod

across B phase was the weakest spot on the bus so it arced across. No

other damage was found on the 6,900-volt bus. It is possible that the

fault on the pulverizer circuit occurred before the fault on the transformer and could have contributed to the transformer fault, but due to the

slight amount of damage on the pulverizer circuit and the high overcurrent

relay setting, we think the transformer fault occurred first. The pulverizer circuit damage appeared to be caused by a high voltage and a low current condition which lasted only a cycle or so.
82

4

March 13, 1973

1H UNIT STATION SERVICE TRANSFORMER INTERNAL EXPLOSION -

It seems to be almost impossible to tell whether or not all protective

relays and auxiliary relays functioned as they should have. The Westinghouse sudden pressure device and the circuit were checked and no trouble

was found except that the control cable to the unit was blown into, but no

doubt this was done after the fault. The bellows in the sudden pressure

device were distorted indicating the device may have operated. We believe

that sudden pressure relay may have picked up and it should have but the

target apparently was not activated. We are positive that the generator

neutral over-voltage relay picked up but probably did not activate the

target. This is the same type relay as the sudden pressure which is a

Westinghouse type SV and the targets are not very reliable on this type

relay. Also, the transformer pressure relief device was inspected and no

trouble was found on it. It did have a target showing that it had been

activated. Apparently the internal pressure was built up so fast that the

pressure relief device set at 10 psig could not relieve the pressure as

fast as it was accumulated.

The generator backup relay, generator overcurrent relay, and generator

neutral voltage relay all apparently operated after the oil circuit breakers and exciter field breakers were opened. The reason for this being the

voltage generated by the residual magnetism in the field and the exciter.

The low-pressure turbogenerator rolled for 100 minutes after it was

tripped and the high-pressure turbogenerator rolled 27 minutes after it

was Iripped. This means that some amount of current was being pushed

through the faulted transformer at a rate governed by the gradual decrease

in speed on the turbogenerators. The sprinkler system was shut off after

approximately twenty minutes of continuous operation and as soon as it was

shut off the oil and insulation reignited and the sprinkler system was

turned back on. This happened several times when the sprinkler system was

turned off.

After making an assessment of the damage and evaluating the sequential

annunciator data and the relay operations as recorded by the operator, a

clearance was obtained and grounds placed on the unit.

The lH unit transformer was disconnected from the generator isolated phase

bus. Most of the isolated phase bus housing and bus connectors between

the unit transformer and the generator bus was damaged and this had to be
83

5

March 13, 1973

1H UNIT STATION SERVICE TRANSFORMER INTERNAL EXPLOSION -

removed and the opening on the generator bus housing closed. This required some heli-arc welding on the housing.

The bus housing cooling fans had pulled oil and soot into the 1H generator

isolated phase bus housing, thus coating the insulators especially on C

phase. All these were cleaned. All main transformer bushings and insulators had to be cleaned. After cleaning, the 1H generator isolated phase

bus was disconnected at the generator and meggered. Also, the 1H generator was meggered. Each was within normal limits. A bushing was broken on

the IL main transformer neutral reactor and this was patched with epoxy.

The 1H and 1L main transformers were disconnected, bridged, tested using

the Doble procedure, meggered, and a ratio check made. Both transformers

indicated abnormal Doble readings, but the readings on each transformer

were identical. A different Doble set was secured from and the

check made. This set indicated the tests were within normal limits. The

transformers and lH generator were reconnected and the unit was released

for service at 9:00 p.m. February 18, 1973, which was 32 hours and 9 minutes after the trip.

It is the writer's opinion that the most likely cause of the fault was a

breakdown in turn-to-turn insulation on the winding which caused a rapid

rise in oil and hot spot temperatures. We base this statement on the

facts that we received; a transformer high temperature annunciation and

that the transformer oil temperature gauge maximum temperature indicating

hand was locked off scale at 1200C and the hot spot temperature gauge maximum temperature hand was locked at 1450C.

The fault on the transformer winding was no doubt adjacent to the bulbs on

the temperature indicators which are located approximately one foot from

the top, down on the side near the center of the transformer. The fault

most probably started on (B) phase winding or the no load tap changer although the contacts on the tap changer were not burned or pitted.

Combustible gas tests have been made monthly on this transformer since it

was put in service in 1966 and no excessive gas readings have been recorded. The last test was made February 5, 1973, at which time the combustible gas reading was .05 percent. The transformer temperature has

never been excessive and the fans only needed to run on the hottest summer
84

6

March 13, 1973

1H UNIT STATION SERVICE TRANSFORMER INTERNAL EXPLOSION -

days. The 0 analysis has also been run monthly on this transformer and

the readings were always within the established limits.

There has been some doubt expressed as to whether the basic insulation

level voltage is as high as it should be on this type transformer due to

the way it is being used. There seems to be some proof that it may not be

high enough due to the fact that each time the transformer winding is

tested using the Doble procedure the power factor readings continue to

show a slight increase. We think this problem merits some further study

to see if this may be the cause of some transformer failures.

Our conclusions are that the transformer and auxiliaries were damaged to

the extent that it would not be economically feasible to repair it. Six

of the eight radiators were damaged beyond repair. These radiators are

machine made and welded onto the transformer. Three cooling fans were

damaged. All current transformers were damaged. The temperature and

liquid level indicators were damaged. The transformer tank walls and top

were damaged beyond repair (see attached photographs). The no-load tap

changer was damaged beyond repair. All bushings were broken and the bus

housing adaptors on the transformers were damaged. See attached estimate

made for repairing transformer by service shops.

There is no record here as to how much voltage is generated at any given

rpm on the turbogenerators with the exciter field breakers open, but a

recording amp meter and volt meter will be installed to record the current

and voltage from turning gear to half speed before the exciter field

breakers are closed. A rough check was made at 300 rpm when the unit was

restored to service after the fault, and approximately 300 volts were read

with exciter field breakers oven. With a turbogenerator and transformers

connected as these were, we feel that a breaker to open the exciter output

to the generator field with short circuiting resistors might be of some

value.

We also feel that a sprinkler system around the hydrogen regulating station in the transformer yard might prevent a hydrogen explosion in the
85

7

March 13, 1973

1H UNIT STATION SERVICE TRANSFORMER INTERNAL EXPLOSION -

future. A considerable amount of insulation oil and debris were blown

onto the hydrogen station when the transformer exploded.

Under conditions such as this the isolated phase bus cooling system should

be deenergized. This should be done when any electrical trip relay is

picked up. Also, there should be an annunciator point on each exciter

field breaker connected to the electrical control wing sequential annunciator recorder. There should be at least two common circuits from electrical trip relays connected to both the electrical control room sequential recorder and the unit control room sequential recorder. There should

be a separate annunciator point for the transformer differential relay

operation and the transformer sudden pressure relay operation, both on the

unit station service transformer and the main transformer relays.

RLT:D3S

Attachments

NRC FO•m 336 1. REPORT N UMEE R (Assigned by DDC) U.S. NUCLEAR REGULATORY COMMISSION NUMERAsnb C BIBLOGRPHI NUREG/CR-31 22

BIBLIOGRAPHIC DATA SHEET ORNL /NSIC-213

4. TITLE AND SUBTITLE (Add Volume No., if eppiooriate) 2. (Leave blank)

Potentially Damaging Failure Modes of High- and MediumVoltage Electrical Equipment 3. RECIPIENT'S ACCESSION NO.

7. AUTHORIS) 5. DATE REPORT COMPLETED

H.C. Hoy MONTH IYEAR ___ ___ __ __ __ __ __ __ __ __ __ ___ __ __ __ __ __JUlY 1983

9. PERFORMING ORGANIZATION NAME AND MAILING ADDRESS (Include Zip Code) DATE REPORT ISSUED

Nuclear Operations Analysis Center MONTH YEAR 3 

Oak Ridge National Laboratory Au lEAgLstve 

Oak Ridge, TN 37830

8. (Leave blank)

12. SPONSORING ORGANIZATION NAME AND MAILING ADDRESS (Include Zip Code) 10 PROJECT/TASK/WORK UNIT NO.

Office for Analysis and Evaluation of

Operational Data 11 FINNO. B1672

U. S. Nuclear Regulatory Commission

Washington, D. C. 20555

13. TYPE OF REPORT PE ROOD COVE RED (Inclusive dates)

Topical through March 1983

15. SUPPLEMENTARY NOTES 14. (Leave olanki

16. ABSTRACT (200 words or less)

The electrical equipment failures of both nuclear and nonnuclear public utilities were

reviewed. Those failures that could pose an additional problem to surrounding and

connected equipment were defined. The literature was searched; utilities, repair shops,

and large electrical equipment users were contacted for failure information. The data

were reviewed in detail, and failure modes were determined. Sample cascade failures

are discussed. The failure rate of electrical equipment in utilities is historically

uite low. Nuclear plants record too few failures to be statistically valid, but

ailures that have been recorded show that good design usually restricts the failure

to a single piece of equipment.

17. KEY WORDS AND DOCUMENT ANALYSIS 17a DESCRIPTORS

Nuclear Power Plants

Failure Modes

Electrical Equipment

Transformers, Switchgear

Cables, Connectors, Control Boards

17b. IDENTIFIERS:OPEN-ENDED TERMS

18 AVAILABILITY STATEMENT

Unlimited

19. SECURITY CLASS (rhis reportl

unclassified 1 21 NO OF PAGES

I -.- -- - - -

120 SECURI TY CLASchPa) 22 PRICE

S

NRC FORM 335 01 8s1




UNITED STATES

NUCLEAR REGULATORY COMMISSION

WASHINGTON, D.C. 20555

FOURTH-CLASS MAIL

POSTAGE & FEES PAID

USN RC

WASH. D. C.

PERMIT No JM

OFFICIAL BUSINESS

PENALTY FOR PRIVATE USE, $300