05000529/LER-1999-005
| Event date: | 9-9-0728 |
|---|---|
| Report date: | 0-0-0529 |
| Reporting criterion: | 10 CFR 50.73(a)(2)(iv), System Actuation |
| 5291999005R00 - NRC Website | |
1. REPORTING REQUIREMENT(S):
This LER (50-529/99-005-00) is being submitted pursuant to 10 CFR 50.73(a)(2)(iv), to report a reactor protection system initiated reactor trip which occurred on June 18, 1999.
2. DESCRIPTION OF STRUCTURE(S), SYSTEM(S) AND COMPONENT(S):
The core protection calculator/control element assembly calculator (CPC/CEAC)(EIIS: JC) system monitors pertinent reactor core conditions and provides an accurate, reliable means of initiating a reactor trip.
The CPC/CEAC system is an integral part of the plant protective system in that it provides departure from nucleate boiling ratio (DNBR) and local power density (LPD) trips to the reactor protection system (RPS) (EIIS: JC). Trip signals are provided to the reactor protection system whenever the minimum DNBR or fuel design limit LPD is approached during reactor operation.
Each CEAC receives reed switch assembly inputs for all control element assemblies (CEAs) (EIIS: AA). The CEACs compare the positions of all CEAs within each CEA subgroup and determine penalty factors based upon CEA deviations within a subgroup. A penalty factor is transmitted via four fiber-optic data links to the CPCs. The CPCs also compute penalties for CEA group out-of-sequence and subgroup deviation conditions.
The CPCs function to monitor pertinent reactor core conditions, calculate and display appropriate results, provide CEA withdrawal prohibit (CWP) signals to the control element drive mechanism control system (CEDMCS) (EIIS: AA) and low DNBR/high LPD trip signals to the reactor protection system (RPS).
The reactor protection system (RPS) provides a rapid and reliable shutdown of the reactor to protect the core and the reactor coolant system pressure boundary from potentially hazardous operating conditions. Shutdown is accomplished by the generation of reactor trip signals. The trip signals open the reactor trip switchgear (RTSG) breakers(EIIS: AA), de-energizing the control element drive mechanism (CEDM) coils(EIIS: AA), allowing all CEAs to drop into the core by the force of gravity.
3. INITIAL PLANT CONDITIONS:
On June 18, 1999, at approximately 2229 MST, Palo Verde Unit 2 was in Mode 1 (POWER OPERATION), operating at approximately 100 percent power. There were no structures, systems, or components that were inoperable at the start of the event that contributed to the event.
4. EVENT DESCRIPTION:
Prior to the reactor trip, at approximately 2205 MST on June 18, 1999, Control Room personnel received two unexpected alarms indicating CPC sensor channel "C" failure and a simultaneous Control Element Assembly Withdrawal Prohibit (CWP). The V channel sensor failure and simultaneous CWP alarms cleared one second later.
Control room personnel initiated responsive actions in accordance with applicable alarm response procedures.
While investigating the alarms, at 2229 MST, the RPS initiated trip signals on low DNBR and approximately six seconds later the reactor trip circuit breakers opened allowing control rods to insert into the reactor (EIIS: RCT, AC). All control rods fully inserted into the reactor core and required safety systems responded as designed.
Four of eight steam bypass control valves directed excess steam flow to the main condenser (EIIS: SG) which remained available throughout the event. No main steam (EIIS: SB, RV) or primary safety valves (EIIS: AB, RV) lifted and none were required. Electrical busses transferred to offsite power (EIIS: BP), and although not required during the event, the high pressure safety injection (EIIS: BQ), residual heat removal (EIIS: BP), and auxiliary feedwater systems (EIIS: BA) remained available and capable of performing their intended safety function.
At approximately 2245 MST, the reactor had stabilized in Mode 3 (HOT STANDBY) and the event was classified as an uncomplicated reactor trip. There were no ESF actuations and none were required. There was no loss of heat removal capability or loss of safety functions associated with the event.
On June 19, 1999, at approximately 0531 MST, CPC trip buffers had been downloaded and trouble shooting efforts had commenced. Initial CEAC #2 troubleshooting efforts could not conclusively identify a failed component, however, failure symptoms and available information suggested that the probable cause of the failure was a malfunctioning CEAC processor board and/or upper and lower core memory. At 1730 MST, on June 19, 1999 the CEAC processor and memory boards had been replaced and CEAC #2 was declared operable upon completion of post maintenance testing.
was synchronized to the grid, at approximately 11 percent power.
On June 21, 1999 at 0332 MST, while at approximately 77 percent power, Control Room personnel received a CEA deviation alarm on CEAC #2 and a CWP alarm. At 0336 MST, CEAC 2 was made inoperable by inserting INOP codes in all four CPCs. The failure was similar to the previous failure however, during the most recent occurrence the CEAC had reset and did not send the high penalty factor data to the CPCs. The remaining CEAC #2 floating point, ALO-multiply-divide and self test circuit boards were replaced and no additional problems were observed. Power ascension continued and at 1400 MST on June 21, 1999, reactor power was stable at 99.5 percent.
5. ASSESSMENT OF SAFETY CONSEQUENCES:
The low DNBR trip is provided to prevent the DNBR in the core from exceeding the fuel design limit in the event of design bases anticipated operational occurrences. The reactor trip occurred when all four channels of CPCs calculated a DNBR value that exceeded the low DNBR tip setpoint The CPC calculated DNBR resulted from an erroneous penalty factor generated in CEAC #2 due to an apparent malfunction in the processor board. The actual DNBR safety limit was not approached nor exceeded.
Primary and secondary pressure boundary limits were not approached due to the reactor tripping from a steady state condition, followed by a "quick open" of the steam bypass control system (EIIS: JI).
The transient did not cause any violation of the specified acceptable fuel design limits. Therefore, there were no safety consequences or implications as a result of this event. This event did not adversely affect the safe operation of the plant or health and safety of the public.
Unit 2 plant performance and plant protection system evaluations were performed to determine plant responses to transients experienced subsequent to the plant trip. The plant performance evaluation included a safety function impact analysis for each of the safety functions and included an assessment of equipment malfunctions, abnormal alarms and/or events observed during the event. The plant protection system evaluation identified reactor protection system and engineered safety features actuations that were observed during the event. The evaluations revealed that the plant responded as required, and the reactor trip was uncomplicated and that no safety limits were exceeded, and that the event was bounded by current safety analyses.
6. CAUSE OF THE EVENT:
An independent investigation of this event is being conducted in accordance with the APS corrective action program. Although additional investigative activities remain to be completed, the cause of the reactor trip appears to be a hardware induced calculational error that resulted in an erroneous penalty factor being generated in CEAC #2 No unusual characteristics of the work location (e. g., noise, heat, poor lighting) directly contributed to the event. No personnel errors or procedural error contributed to this event == 7. CORRECTIVE ACTIONS TO PREVENT RECURRENCE: ==
Control Room Operator action was taken to place the reactor in a stable condition in accordance with the appropriate operating procedures. Troubleshooting activities were commenced but were unsuccessful in isolating a specific failed subcomponent. APS Engineering evaluated available data, Control Room Operator observations, and past CEAC failures, and determined that an apparent malfunction in a processor board caused CEAC #2 to generate an erroneous penalty' factor. The CPCs correctly processed the erroneous DNBR penalty factor and initiated a reactor top signal.
The CEAC #2 processor and memory boards were initially replaced and subsequently the floating point, ALO-multiply-divide and self test circuit boards were also replaced. As part of the investigation, an equipment root cause of failure analysis of CEAC #2 is being performed by APS Engineering. The preliminary evaluation has not identified any specific subcomponent failure(s) which would cause the CEAC to malfunction. If information is subsequently developed that would significantly affect the readers' understanding or perception of this event, a supplement to this LER will be submitted.
8. PREVIOUS SIMILAR EVENTS:
A similar event occurred on October 29, 1994, when the Palo Verde Unit 2 reactor topped from 100 percent power following a low DNBR trip signal. The trip signal was initiated from the Core Protection Calculators (CPC) after processing an erroneous penalty factor generated by CEAC #1.
9. ADDITIONAL INFORMATION:
The reactor trip was a single actual initiating event that affected only the initiating event cornerstone in the new regulatory oversight and assessment process. (The new regulatory oversight and assessment process is currently in the pilot phase.) The event was tabulated as an "Unplanned Scram" in the performance indicator category of initiating events. Risk significance is factored into the "Unplanned Scrams" performance indicators threshold limits. As such, application of the NRC Significant Determination Process was not used to assess or estimate the risk significance associated with the event.
- END OF DOCUMENT ***