05000528/LER-2002-001
| Palo Verde Nuclear Generating Station Unit 1 | |
| Event date: | |
|---|---|
| Report date: | |
| Reporting criterion: | 10 CFR 50.73(a)(2)(ix)(A) 10 CFR 50.73(a)(2)(iv)(A), System Actuation |
| Initial Reporting | |
| 5282002001R00 - NRC Website | |
1. REPORTING REQUIREMENT(S):
This LER (50-528/2002-001-00) is being submitted pursuant to 10 CFR 50.73(a)(2)(iv)(A), to report a reactor protection system (RPS) (EIIS: JC) initiated reactor trip which occurred on November 10, 2002 at approximately 2250 Mountain Standard Time (MST).
On November 11, 2002 at 0228 MST, APS made notification of the event to the Nuclear Regulatory Commission (NRC) via the event notification system (ENS# 39361).
2. DESCRIPTION OF STRUCTURE(S), SYSTEM(S) AND COMPONENT(S):
The core protection calculator/control element assembly calculator (CPC/CEAC)(EIIS: JC) system monitors pertinent reactor core conditions and provides an accurate, reliable means of initiating a reactor trip. The CPC/CEAC system is an integral part of the plant protective system in that it provides departure from nucleate boiling ratio (DNBR) and local power density (LPD) trips to the reactor protection system (RPS) (EIIS: JC). Trip signals are provided to the reactor protection system whenever the minimum DNBR or fuel design limit LPD is approached during reactor operation.
Each CEAC receives reed switch assembly inputs for all control element assemblies (CEAs) (EIIS: AA). The CEACs compare the positions of all CEAs within each CEA subgroup and determine penalty factors based upon CEA deviations within a subgroup. A penalty factor is transmitted via four fiber-optic data links to the CPCs. The CPCs also compute penalties for CEA group out-of-sequence and deviations between subgroup conditions.
The CPCs function to monitor pertinent reactor core conditions, calculate and display appropriate results, provide CEA withdrawal prohibit (CWP) signals to the control element drive mechanism control system (CEDMCS) (EllS: AA) and low DNBR/high LPD trip signals to the reactor protection system (RPS).
The reactor protection system (RPS) provides a rapid and reliable shutdown of the reactor to protect the core and the reactor coolant system pressure boundary from potentially hazardous operating conditions. Shutdown is accomplished by the generation of reactor trip signals. The trip signals open the reactor trip switchgear (RTSG) breakers (EIIS: AA), de-energizing the control element drive mechanism (CEDM) coils (EDS: AA), allowing all CEAs to drop into the core by the force of gravity.
3. INITIAL PLANT CONDITIONS:
On November 10, at approximately 2250 MST, Palo Verde Unit 1 was in Mode 1 (POWER OPERATION), operating at approximately 64 percent power. The Unit was 10 minutes into a planned shut down to take the Unit offline to do maintenance work on the shutdown cooling system. There were no major structures, systems, or components that were inoperable at the start of the event that contributed to the event.
4. EVENT DESCRIPTION:
At 2250 MST on November 10, 2002 the PVNGS Unit 1 Reactor automatically tripped from approximately 64% power. The Unit had initiated a planned shut down at 2240. Initial core conditions were 69% power with all CEAs fully withdrawn. The trip occurred as part length control element assemblies (PLCEA) in Group P were being inserted from 144" withdrawn to 139.5" withdrawn for ASI control during the down power. Regulating Group-5 had already been inserted to 144" withdrawn and a 25-gpm boration was in progress. The CPCs tripped the reactor on low DNBR. During the Group P CEA movement, CEA48 had not moved below 147.0" withdrawn. As a result, a CEA deviation caused a large penalty factor to be transmitted to the CPCs. Each CPC received a DNBR penalty factor, initially from CEAC1, then from CEAC2. Given the penalty factor received from the outward deviation of CEA48 by greater that 9.0 inches from the group, the CPCs responded appropriately protecting the fuel clad barrier from a possible localized high power condition.
The reactivity manipulations were being made in accordance with an approved Operations/Reactor Engineering plan for downpower from 69% Reactor Power. The downpower was being performed for Short Notice Outage Work (SNOW) scheduled to correct vibration problems with Shutdown Cooling System Suction Valve 1JSIAUV0651. The control room staff entered the emergency operating procedures and diagnosed a Reactor Trip. The control room staff also entered Abnormal Operating Procedure 40A0-9ZZ05 due to loss of letdown post- trip. Loss of letdown occurred post-trip when CHB523 closed on low nuclear cooling (NC) flow. Letdown was reestablished at approximately 2305. The Shift Manager classified the event as an Uncomplicated Reactor Trip. The NRC Operations Center was notified in accordance with 10CFR50.72 (b)(2)(iv)(B) for a 4-hour report at 0228 hours0.00264 days <br />0.0633 hours <br />3.769841e-4 weeks <br />8.6754e-5 months <br /> MST, on November 11, 2002.
The CEAC deviation alarm actuated seconds before the trip. The CEA deviation alarm in the top deadband is set at 2.25" above the penalty threshold of 139.26" withdrawn. The conditions for this alarm are that the deviation magnitude be equal to or greater than 5.5" and that the lowest CEA in the subgroup be below 141.51". A review of the CEAC Trip Buffer Reports indicate that both conditions were met. Therefore, the deviation alarm was received shortly before the unit trip per design. It should be noted that the pulse counter for CEA 48 was counting normally, so major and minor deviation alarms were not generated from COLSS as a warning of increasing deviation.
5. ASSESSMENT OF SAFETY CONSEQUENCES:
The low DNBR trip is provided to prevent the DNBR in the core from exceeding the fuel design limit in the event of design bases anticipated operational occurrences. The reactor trip occurred when all four channels of CPCs calculated a DNBR value that exceeded the low DNBR trip setpoint. The cause of the reactor trip was a hardware induced CEA position deviation error that resulted in a large penalty factor being generated in both control element assembly calculators (CEAC1 and CEAC2). CEA 48 failed to insert due to the failure of an optical isolator card in the CEDMCS system. The CPC calculated DNBR resulted from a penalty factor generated in CEAC1 and CEAC2. The actual DNBR safety limit was not approached nor exceeded.
Primary and secondary pressure boundary limits were not approached due to the reactor tripping from a steady state condition, followed by a "quick open" of the steam bypass control system (EllS: JI). The transient did not cause any violation of the specified acceptable fuel design limits.
Therefore, there were no safety consequences or implications as a result of this event. This event did not adversely affect the safe operation of the plant or health and safety of the public.
Unit 1 plant performance and plant protection system evaluations were performed to determine plant responses to transients experienced subsequent to the plant trip. The plant performance evaluation included a safety function impact analysis for each of the safety functions and Y included an assessment of equipment malfunctions, abnormal alarms and/or events observed during the event. The plant protection system evaluation identified reactor protection system and engineered safety features actuations that were observed during the event. The evaluations revealed that the plant responded as required, the reactor trip was uncomplicated, no safety limits were exceeded, and the event was bounded by current safety analyses.
Since all four channels of the CPCs functioned, the condition is not a loss of a safety function as defined by 10CFR50.73(a)(2)(ix)(A).
6. CAUSE OF THE EVENT:
The direct cause of the failure of CEA48 to move with its group was determined to be a failed optical isolation card in the CEA control system. This was identified during approved troubleshooting activities the afternoon following the reactor trip. Following replacement of the card, CEA48 was exercised successfully both individually and with the rest of the group. Since the direct cause of the DNBR unplanned trip had been identified, and all standard evaluations required by plant procedures had been completed, authorization for reactor restart was requested. The Plant Review Board (PRB) unanimously authorized reactor restart.
7. CORRECTIVE ACTIONS:
Interim actions were implemented to prevent recurrence of an unplanned reactor trip during planned CEA movement should an individual CEA fail to move with its group. This has been accomplished by adding procedural guidance for increased CEA position monitoring to compensate for the CEA alarm deadband. The revised procedure was communicated to licensed operators with a Night Order, which included an event summary.
A simulator presentation is being developed to demonstrate the event in an upcoming Licensed Operator Continuing Training (LOCT) cycle.
Removing the alarm deadband for CEA deviation is currently being pursued. A change to the CEAC reload data block is being evaluated that would change the alarm deadband (upper and lower) without changing the deadband for the application of the CPC penalty factor (RPS Trip) giving Operators sufficient notification by enabling deviation alarms at all CEA positions.
4.; outage will also permit all CEA RPS Trip positions to be displayed and monitored.
8. PREVIOUS SIMILAR EVENTS:
In the past three years, there have been no previous similar events reported pursuant to 10CFR50.73.
9. ADDITIONAL INFORMATION:
The reactor trip was a single actual initiating event that affected only the initiating event cornerstone in the regulatory oversight and assessment process. The event was tabulated as an Unplanned Scram in the performance indicator cornerstone of initiating events.