At Forsmark Multiple Safety Layers were Effective in protecting the reactor from the consequences of multiple failures in some electronic circuits.

by Frigyes Reisch, Sweden

International Electrotechnical Commission (IEC), Lyon 2006 Meeting

“Much ado about nothing” these famous words of Shakespeare fit well the excitement that was generated over some trivial failures that took place at Forsmark. A word from an angry person about the distant possibility of core meltdown got the Swedish and international press - and of course the anti-nukes in a frenzy - ,
even though nothing dramatic actually happened at the plant.

On July 25, in the high voltage (400 kV) switch yard during maintenance work a short circuit between two phases occurred because an energized disconnector was opened and thereby an arc arose (see the Simplified single line wiring diagram). The following transient (see the Voltage perturbation diagram) revealed some inaccurate adjustments in a couple of electrical circuits. The reactor was automatically shut down. That worked correctly.

The “uninterruptible” power supply systems (UPS) are configured with an AC/DC converter that fed the batteries and a DC/AC converter that support the uninterrupted power supply bus bar (see the simplified principal block diagram). The diesel generators’ speed controls that are necessary for diesel start are supplied from the UPS fed bus bars. The perturbation on the ordinary power supply penetrated through the system. The internal protection system disconnected the DC/AC converter prior to the AC/DC converter’s protection, for two of the four UPS.

The main generator’s low frequency protection was installed with erroneous phase order and therefore did not disconnect the 20 kV generator breakers in time. That disconnection would have connected in
an alternative (70 kV) power supply. The alternative power supply, like the diesels were connected in to the system manually some twenty minutes later.

Now all three Forsmark reactors are in operation
The main improvements made are as follows; the battery secured network was made to endure severe disturbances, DC power supply to the diesel generators is assured, faulty indications in the control room at the loss of power supply are corrected, the gas turbines at the plant can be started from the control room.

With hindsight there are a few observations that we can make: the robust rotating DC/AC converters were replaced with new electronic boxes and so were the AC/DC converters, also the low frequency actuation protection of the generator breakers was replaced with new ones. All these new electronic boxes were tested individually, no integrated tests were performed. Previously, tests were required to disconnect the grid and to follow how the on-site power supply fulfilled its function. This insight had been lost in recent years.