05000263/LER-2008-008
| Docket Number | |
| Event date: | 11-13-2008 |
|---|---|
| Report date: | 01-08-2009 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(i)(B), Prohibited by Technical Specifications |
| 2632008008R00 - NRC Website | |
Event Description
Following an industry refueling Shutdown Margin (SDM) best practice published July 2008 by the Reload Analysis and Core Management Committee (RACMC) of the BWR Owner's Group (BWROG-TP-08-011 "RACMC Best Practice Guideline — Refueling Shutdown Margin RACMC-BPG-2008-02, Revision 0"), the Nuclear Analysis Department (NAD) evaluated the best practice. NAD tested the practice on the core alterations made during the last Refuel Outage in 2007 (RF023) with SIMULATE-3, taking into account both a core exposure dependent bias and the use of a three-dimensional method. On November 13, 2008 it was determined that the Technical Specification (TS) SDM was not met for all conditions during the refuel outage.
Monticello Nuclear Generating Plant (MNGP) TS action 3.1.1a requires the reactor SDM to be greater than or equal to 0.38% AK/K at all times with the analytically determined highest worth control rod fully withdrawn. Calculations performed by the NAD indicated that SDM at the most limiting point during the End of Cycle (EOC)-23 core alterations (March/April, 2007) was -0.86% AK/K assuming control rod 38-15 fully withdrawn (which it was not). This indicates that the reactor would have been critical if the highest worth control rod [ROD] had been fully withdrawn. During RFO 23, a core configuration led to the condition that initially violated TS for SDM. All control rods in reactor cells containing one or more fuel bundles were fully inserted throughout the core alterations. Control rods in cells with no fuel bundles have no reactivity worth. Administrative controls in place throughout the core alterations ensured that the proper control rod configurations were maintained.
Event Analysis
The event was reportable under 10 CFR 50.73(a)(2)(i)(B) Operation or Condition Prohibited by Technical Specifications. There were no 10 CFR 50.72 reporting criteria for this event.
The event is not considered a safety system functional failure since all safety related systems were able to perform their safety functions.
Safety Significance
The station Probabilistic Risk Analysis (PRA) group reviewed the event and provided the following safety significance. Risk of core damage and large early release from this TS violation is limited for several reasons. For core damage to occur, a control rod that does not meet the SDM specification must be inadvertently withdrawn to the point of causing a reactor criticality event. The resulting power increase must be in excess of that which would cause damage to the fuel. Inadvertent withdrawal of a control rod is unlikely for several reasons.
Control rod movement during core alterations is limited to a single rod at any given time by refueling interlocks that are in place while in Mode 5 (Shutdown or Refuel). Control rod movement is administratively prohibited in fuel cells that contain one or more bundles of fuel.
Fuel and control rod movement is accomplished using a strict procedure that requires verification of all moves. While shutdown and in the process of performing core alterations, consequence of reactor criticality resulting from inadvertent control rod withdrawal at normal rod speed is not expected to approach conditions that would lead to core damage. Analyses show that power increase is terminated by a combination of fuel temperature feedback (Doppler) and a reactor scram, prior to reaching conditions that come close to threatening fuel and/or fuel clad integrity. The reactor scram function is enhanced during core alterations due to the removal of shorting links that place the Source Range Monitors (SRM) scram function in service, and shift to a non-coincident scram configuration for both SRMs and Intermediate Range Monitor's. The SRM rod block is effective in terminating rod withdrawal upon reaching preset power limits.
The probability of core damage (and subsequent large early release) can be bounded by considering the probability of inadvertently withdrawing any control rod, multiplied by the probability that the inadvertently withdrawn control rod is one for which SDM is not met, and then multiplied by the probability that the reactor scram is unsuccessful in turning power, along with Doppler, in time to preclude core damage. The probability of core damage (and subsequent large early release) is then estimated to be 2.7 E-09. In conclusion, it is reasonable to state that the probability of a core damage event, and therefore a large early release, as a consequence of failing to meet the SDM TS requirement (LCO 3.1.1) during RFO 23 was very small.
Cause
The root cause for not meeting the SDM during RFO 23 was insufficient verification and validation using higher order (known and industry accepted) method for determination of TS SDM compliance. The investigation found that a two-dimensional computer program (BFACCTS) was still utilized for calculating refueling SDM at MNGP. A two-dimensional program cannot accurately calculate refueling SDM on a consistent basis. A three dimensional model is needed to provide a consistent and accurate calculation of refueling SDM. This is considered a latent human performance error since the original program was implemented in 1988. A contributing cause is that BFACCTS was not classified as safety related and as Level 1 in the SQA process. In 1988, when BFACCTS was developed, the TS for SDM only applied to the operating cycle and not to core alterations between cycles.
Corrective Action Only three-dimensional models will be utilized to determine SDM during core alterations and the operating cycle. This will be in place prior to planning for RFO-24 core alterations to prevent recurrence of the TS violation.
Failed Component Identification None
Previous Similar Events
None