IR 05000528/1988020

Insp Rept 50-528/88-20 on 880525-26,0606-10 & 24.Violation Noted.Major Areas Inspected:Circumstances Surrounding Reactor Startup of Unit on 880514 in Which Reactor Went Critical W/Control Element Assemblies Below Tech Spec Limit

ML20151J837
Person / Time
Site:	Palo Verde
Issue date:	07/12/1988
From:	Coe D, Miller L, Pate R NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION V)
To:
Shared Package
ML20151J816	List: IR 05000528/1988020 ML20151J811
References
50-528-88-20, NUDOCS 8808030062
Download: ML20151J837 (23)

Text

._

,

.. .

,

U. S. NUCLEAR REGULATORY COMMISSION 2- REGION V Report No: 50-528/88-20 Docket-No. 50-528 License No. NPF-41- EA #182 Licensee: Arizona Nuclear Power Project Facility Name: Palo Verde Unit 1 Inspection at: Wintersburg, Arizona (Palo Verde Site)

Inspection Conducte : May 25-26, une 6-10, June 24, 1988

'

. Inspectors: .

LU F. Miller CM f, Reactor ProjectsSection II Date Signed w . 7- & 90 D. Coe 'icense x ine Date Signed A

>-6fV _

Af Y 7 // L {

R. Pate, Chief, Reactor Projects Branch Date Sidned Accompanying Personnel: R. Marsh, Director, Office of Investigations, RV T. Polich, Senior Resident Inspector, Palo Verde M. Davi , P , et Manager, Palo Verde Approved by:

" '

Pate, Ch cf, Rehctor Projects Branch 7/M/8[

Qdte Srgned Sunmary: .

Inspection between May 25-26, June 6-10, and June 24, 1988 l (Report 50-528/88-20)

i Areas Inspected: This special inspection by regional inspectors reviewed the circumstances surrounding a reactor startup of Palo Verde Unit 1 on May 14, 1988, in which the reactor went critical with the Control Element Assemblies (CEAs, commonly known as control rods) inserted below the technical specification limit. Inspection Procedures 93702 and 30703 were used.

Results

In the area inspected, six violations were identified: failure to identify a significant calculational error as a nonconformance (Paragraph 4),

entry into Mode 2 with CEAs below the Transient Insertion Limits (Paragraph Sa), improper control of reactivity during conduct of startup procedure (Paragraph Sb), failure to immediately borate the reactor with apparently inadequate shutdown margin (Paragraph Sc), failure to record reactor criticality (Paragraph 5d), and failure to report this event es required by 10

- CFR 50.72 (Paragraph Se). In addition, the licenwe's post telp review report was not adequate in scope and depth to allow the licensee to fully understand

- the event, and to initiate adequate corrective cctiors prior to restart of Palo Verde Unit PDR ADOCK 05000528 G PNU

.___ .

. ,___ .- , .

. _ __ . - - _ , .

, .

,

.

DETAILS Persons Contacted

• D. Karner, Executive Vice President E. Van Brundt, Executive Vice President

• J. Haynes, Vice President, Nuclear Production

• J. Allen, Plant Manager, Unit 1 S. Zerkel, Control Room Supervisor G. Waldrep, Shift Technical Advisor L. Clyde, Shift Techncial Advisor Supervisor R. Younger, Operations Manager, Unit 1 J. Kreighbaum, Shift Supervisor D. Alan Johnson, Senior Compliance Engineer K. Quihuis, Primary Reactor Operator D. Hoppes, Reactor Engineering Supervisor 8. Miller, Nuclear Fuels Supervisor R. Butler, Director, Standards and Technical Support W. Fernow, Training Manager R. Wells, Instructor R. Simmons, Instructor The inspectors also had discussions with other licensee personnel during the inspectio * Attended the Exit Meeting on June 10, 198 . Overview On May 1?, 1988, at approximately 3:30 a.m., while conducting a routine reactor startup, the Palo Verde Unit 1 reactor went critical below the Transient Insertion Limit (commonly referred to as the Power Dependent Insertion Limit, or PDIL) for the control rods (CEAs). The PDIL is 60 inches withdrawn on Group 3 for Unit 1 Cycle 2. The predicted CEA position at criticality was Regulating Group (RG) 4 at 90 inches withdrawn,120 inches of sequential CEA motion above the PDI (Operation with the reactor critical below this limit is prohibited by the Technical Specifications to provide adequate shutdown margin for all anticipated occurrences, including a main steam line break and a rod ejection accident.) The reactivity error in the estimated critical position was in excess of 900 pcm (0.9% k/K).

Special inspections were conducted on May 25-26, June 6-10, and June 24, 1988; also, the resident inspector staff conducted a reactive inspection of the event on May 15-17, 1988. The purpose of these inspections was to determine what had occurred, the circumstances which permitted the event to occur, and the licensee's corrective actions as a result of the even The inspections on June 6-10 and June 24, 1988, were performed in conjunction with an investigation by the NRC Office of Investigations (0I) to determine if there had been intentional wrongdoing in the

w -1 l

' -

' j

.

i performance of the.startup procedure or documentation of the associated event The inspections consisted of a review of the logs, procedures, calculations, Post Trip Review Reports (PTRR), and interviews conducted jointly with OI of the involved operators, licensee managers, and supervisors. Enclosure 1 provides a listing of the information reviewe The inspectors concluded that on May 14, 1988, at approximately 3:30:17 a.m., the Unit 1 reactor went critical at approximately 47 inches withdrawn on CEA Group This position was 133 inches of sequential CEA motion below the planned critical position, and 13 inches below the PDI The principal cause for the criticality event was a decision by the shift supervisor to permit the startup to proceed when the estimated critica position was clearly in error. Contributing causes were an unknown error in the xenon reactivity program, a 3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> delay in the startup beyond the estimated time of criticality, and too rapid an approach to criticality by the primary reactor operator conducting the startu Other concerns identified by the inspectors were inadequate recordkeeping and reporting of the event by the control room operators, inadequate investigation by the licensee of some aspects of the event, inadequate focus on the root cause of the event by the licensee, inadequate technical review of the xenon calculation coefficients by the Nuclear Fuels and Reactor Engineering Departments, and failure to meet the requirements of the shutdown margin technical specification to restore an apparent lack of adequate shutdown margin at the time of the criticalit . Reconstruction of the Event Chronology The licensee's PTRR 1-88-003, provided a narrative and a chronology describing the even This PTRR provided the licensee's documented analysis and corrective action plan to restart Palo Verde 1 on May 16, 1988. Supplement 1/ Revision 1 to the PTRR was issued June 6, 1988, during this inspection, after the inspectors had discussed certain omissions and errors in that report with the licensee. To assess this description independently, the inspectors analyzed the Control Room strip chart recording of the log power and startup count rate data (SEN JR 1A and SEN JR 5), and the Plant Monitoring System (PMS) alarm typer and Sequence of Events printout The inspectors reconstructed a detailed sequence of events using two method First, the PMS alarm typer provided a detailed record of approximately when CEAs were withdrawn. Using these times, and the assumption of thirty inches per minute CEA group speed (provided by the licensee), CEA position versus time was inferre The exact time of the reactor trip was available from the non-buffered Sequence of Events alarm time (3:35:49 a.m. ) The inferred positions were subject to some inaccuracy due to the potential storage of alarm typer data for unknown periods in the PMS memory buffers when the PMS Central Processing Unit had higher priority tasks. This potential inaccuracy was demonstrated to be relatively small in this event, as discussed belo _ _ _ -- ___,__ . _ . _ . _ . . , _ _

.

. .

.

Second, the inspectors performed a graphical analysis of the log power strip chart to measure the startup rate reached after the final rod withdrawal, and to measure.-the time intervals between clearly identifiable areas on the strip char The inspectors assessed the accuracy of the sequence derived from the alarm typer data in three ways: The accumulated regulating groups' CEA motion inferred from the PMS alarm typer data was compared to the expected 145 inches of total CEA travel available for Regulating Groups 1 and The alarm typer inferred travel was approximately 6% greater than the expected travel, a measure of the overall error due to PMS buffer delay time (and other unknown contributing errors). The primary reactor operator who was physically conducting the startup stated categorically to the inspectors that RG 3 CEAs were withdrawn to 30, 45,.and 60 inche The inferred positions which most closely correspond to these positions were 27.5, 40.5, and 6 inches, respectivel Throughout this report, references will be made to the 30, 45, and 60 inches withdrawn' position on RG These positions will refer to the operator's stated CEA position, not the corresponding inferred position, unless specifically note . A simple chronology of key events was deduced from the log power strip chart, and compared with the alarm typer chronology. The log power strip chart was magnified 3.35 times and carefully examined for clearly recognizable feature Four clear features were apparent and a trial assumption of what thay were was made (Figure 1): a power' level plateau when RG 3 CEAs were at abcut 30 inches withdrawn, another plateau when RG 3 CEAs were about 45 inches withdrawn, the peak of power reached (4 X 1C ~3 % power), and the prompt drop in power when the reactor tripped. The distances between these points were converted to times using the known reactor trip time as the anchor time, and compared to the alarm typer times for the same even The graphical analysis time intervals differed from the alarm typer time intervals between these events by an average of 10%. The trial assumption for each features was consistent with the alarm typer predictions, even with the l differences in exact times of features between the alarm typer and l the strip chart (Enclosure 2).

The inspectors concluded that the alarm typer chronology of rod i

withdrawals up to the time of the reactor trip was adequate to infer l approximately when each CEA movement had occurred (Enclosure 3).

l l Review of the Post Trip Review Report (PTRR)

l l The inspectors estimated, from the sequence of CEA movements and the l graphical measurement of reactor startup rate when RG 3 was 60 inches l withdrawn, that Unit I went critical at 47 inches withdrawn on RG 3 at 3:30:17 (Enclosure 4). This position was arrived at by a two step procedure: graphically fitting the log power strip chart to measure the reactor startup rate during the period the CEAs were approximately 60 l

. _ _ - - - .

.

' '

.

.

inches withdrawn; then using a simplified one group, point reactor kinetics, equation for reactivity knowing the startup rate, effective delayed neutron fraction, and effective delayed neutron decay _ constan The last two coefficients were provided by the licensee with a supporting analysis which appeared adequat The inspectors combined this result with the inferred CEA movements and compared it to the PTRR analysis. It was concluded that the event description contained in the PTRR, and to a lesser degree, its Supplement 1/ Revision 1, were inaccurate in certain important respects. The following factual errors in the PTRR were noted: The PTRR stated that "According to the alarm typer the CEA withdrawal (from 45 inches on RG 3 to 60 inches) was made in three distinct steps, taking (approximately) 5 minutes to comolete."

However, the_ alarm typer data indicated that this withurawal of RG 3 occurred in-three steps, one of 11 inches with a wait of one second, followed by one of nine inches with a wait of four seconds, followed by one of one inch. The total sequence apparently took only 47 seconds, not five minutes. This withdrawal occurred after the startup channels' count rate had increased significantly. Count rate had' doubled twice during the withdrawal of the regulating groups to the RG 3 30 inches _ withdrawn position, and'had increased at least 56 % more during withdrawal of the RG_3 CEAs to the 45 inches withdrawn position. It had doubled more than four times (a sixteenfold increase) since the initial CEA withdrawal of the shutdown banks (the primary reactor operator stated in an interview with the inspectors that the inital startup channel' count rate was approximately 100 cpm). The inspectors concluded that criticality was or should have been clearly recognized to be imminent at the 45 inches withdrawn position, The PTRR stated that "After the 15. inch withdrawal (to 60 inches withdrawn), both the Primary Operator and the CRS concluded that the reactor was slightly supercritical, and, hence, the critical CEA position was between 45" and 60" " The term "slightly supercritical" is defined in the licensee's reactor startup procedure, 410P-1ZZO3, Step 4.3.21,: as "approximately .2 dpm."

However, the log power st', p chart clearly indicated that power war, increasing well in excess of .2 decades per minute (dpm) (the measured slope is approximately .70 dpm). Revision 1 to the PTRR did not change this statement, but did state, variously, that "the plant may have entered Mode 2 (Keff >' 1.0 (sic)) when the CEAs were below the PDIL limit of 60" withdrawn," but also that "the reactor was critical at a position of < 60" on Group 3 outside the PDILs." The PTRR stated that "After each withdrawal increment, a two to three minute wait time was established to allow count rate / power level to stabilize." To the contrary, the wait times reconstructed from the alarm typer data varied from one minute four seconds to four minutes twenty one seconds for RG 1 and RG , .-_ .- . - , , -. .- . - .. - -. - -- - - - -

.

.

'

.

The effect of alarm typer timing error discussed above,did not significantly affect this conclusion (The errors in the alarm typer times amount to only nine secords at the worst point (the 40.5/45 inch withdrawn position). Also, withdrawals were confirmed to have been approximately 30 inches each for RG 1 and RG 2), The PTRR stated that "The CPC trip buffers are not reset until the critical rod height data is taken, as stated in 410P-1ZZ03."

However, Procedure 410P-1ZZ03, Reactor Startup, Step 4.3.24, requires that the CPC trip buffers be reset prior to exceeding 1 X 10-4% reactor power. This action precedes taking critical rod height data, which is required to be done by Step 4.3.25 when power is stabilized at 1 X 10-4% reactor powe The inspectors identified several concerns with the scope and depth of the PTRR, and, to a lesser extent, its Supplement 1/ Revision 1: The PTRR "Concern Surmiary" did not identify clearly the underlying (or root) cause for the criticality event. After reviewing the event reconstruction and interviewing all involved licensee personnel, the inspectors concluded that the root cause of this event was a failure to recalculate the Estimated Critical Condition (ECC) at the RG 3, 30 inches or the RG 3, 45 inches withdrawn position when the existing ECC was clearly in error. Recalculation would have resulted in a higher required critical boron concentration, and criticality would have occurred within the PDIL, even accounting for the other errors in the ECC which were not recognized at the tim The PTRR assessment of the error in the ECC assumed the reactor was critical at 60 inches withdrawn on RG 3, when it was clearly supercritical. This underestimated the error in the ECC by approximately 127 pcm. Revision 1 added a new section, "Reactor Engineering's Criticality Determination" which estimated that the reactor had gone critical between 50 and 55 inches withdrawn on RG 3 on the assumption that the startup rate following the withdrawal of RG 3 to 60 inches was between .5 dpm and .25 dp However, Enclosure 4 shows, for reference, that both of these rates are less than actnally experienced during the event of May 14, 1988. The PTRR revision recalculated the total ECC using the unsupported assumption that the reactor was critical at 55 inches withdrawn on l RG 3. The inspectors noted that, for purposes of bounding the ECC error, criticality could have been assumed to occur at the last known subcritical position (45 inches withdrawn on RG 3), given the rapid withdrawal of CEAs to 60 inches from 45 inches by the reactor l operator.

! The inspectors learned in an interview of a licensee employee that the licensee was aware that an erroneous half life had been assumed for xenon in the Cycle 2 xenon calculation coefficients provided to the Unit 1 operators by the Nuclear Fuels and Reactor Engineering l groups. This mistake accounted for a 256 pcm error in the EC This was disclosed by the licensee during the inspection, but was

'

! not reflected in either the PTRR or its Revision 1, both of which l preceded the inspection interview. The inspector located and

'

reviewed the calculation, NA-PV1-C02-87-54-00 "Response to l

__ _

_ _ . _ _ _ . . .

.

.

'

.

EER-87-RX-019, "UlC2 XE-0AP Tables and Coefficients,"", and confirmed that a value -5 f the xenon decay constant was explicitly stated to be 1.83 x 10-5, contrary to its known value of approximately 2.1 x 10 . The error was apparently never identified explicitly by the licensee as a condition adverse to quality, even though it was recognized as an error by the Nuclear Fuels department and corrected in a subsequent calculation progra This is an apparent violation of 10 CFR Part 50 Appendix B, Criterion XVI, Corrective Action, and of the ANPP Quality Assurance Program and procedure The inspectors determined that the "Sequence of Events" in the PTRR was in error in indicating that RC 3 was 45 inches withdrawn at 3:24:32 since the alarm typer reconstruction indicated that RG 3 was only at approximately 30 inches withdrawn (27.5 by reconstruction)

at this tim This error was consistent with the error noted above concerning the duration of CEA withdrawals from the 45 inch withdrawn position. Revision 1 to the PTRR indicated that the 3:24:32 time was "based on operator's statements." The only statements which were documented by the licensee as part of the PTRR or its revision were the Personnel Statements. These did not contain this informatio The inspectors learned that the operators had been interviewed by licensee personnel on May 15. These interviews were not documented as part of the PTRR or the PTRR data package of supporting informatio Considering the above mentioned errors, the inspectors concluded that the PTRR issued was not adequate because it had not proved sufficiently to identify and correct the errors which had been made by the operators but not included in the logs or post event statement This failure to discover several key aspects of the event prior to the decision to restart Palo Verde Unit 1 on May 16, 1988, deprived the licensee of the opportunity to develop a complete program of corrective actions prior to restart of the reacto . Review of the Conduct of the Reactor Startup The inspectors interviewed the Primary Reactor Operator, Control Room Supervisor, Shift Technical Advisor, and Shift Supervisor who conducted the reactor startup of May 14, 1988. In addition, the Control Room Log, Shift Supervisor's Log, Shift Technical Advisor's Log, and Personnel Statements included in the PTRR data package were obtained and reviewe These were compared with the NRC-reconstructed chronology, strip charts, and the licensee's PTR The operators conducted the startup using Procedure 410P-1ZZO3, Revision 7, "Reactor Startup." The inspectors identified several associated performance errors and violations of regulatory requirements: Fundamentally, the Shift Supervisor did not adequately supervise the reactor startup and failed to require the recalculation of the ECC prior to criticalit Recalculation would have prevented the subsequent criticality which occurred outside the permitted CEA position.

l

- -

.- . . - - - - ,- -- ,, . .

..

-

.

The PTRR stated'that the Shift Supervisor "was correctly maintaining the "broadest perspective" on overall plant response," but Supplement 1/ Revision _1 stated he "should have been more involved in this evolution."

The inspectors noted that Procedure 40AC-9ZZO2, "Conduct of Shift Operations," required the Shift Supervisor to "maintain the broadest perspective of operational conditions affecting the safety of the plant as a matter of the highest priority at all times when on duty in the Control _ Room." An interview of the Shift Supervisor was conducted to assess his perspective of the startup. The Shift Supervisor stated that he had delegated responsibility for the startup to the Control Room Supervisor, a. licensed Senior Reactor Operator, and that the Shift Supervisor considered his function to be "to screen calls (of which there were no significant ones recalled), and watch the rest of the plant." This included a roving control board walkdown and review of the Safety Equipment System Status (SESS) panel. The Shift Supervisor stated that he was not aware that the startup count rate had doubled on the withdrawal of RG 3 to 30 inches withdrawn, that he was not aware that the reactor was considered nearly critical by the Control Room Supervisor and Shift Technica; Advisor on the withdrawal of RG 3 to 45 inches withdrawn, that he was "surprised" by the power escalation during the startup, and that when RG 3 was 60 inches withdrawn, he had noticed reactor power was 10-3%, and considered the reactor to be

"very nearly critical."

From the interviews conducted of the Shift Supervisor, it was apparent that he haa not maintained a broad perspective of the prcgress of the startup. To the contrary, his perspective was limited by his ignorance of crucial details of the startup's progres Accordingly, the inspectors concluded that the Shift Supervisor's failure to maintain adequate perspective of the startup resulted in his decision to not reperform the ECC when it should have been apparent to him that the.ECC was seriously in erro The inspectors recognized that the reactor startup procedure permitted an ECC to be up to four hours old, and, in Step 4.3.14, permitted bringing the reactor critical more than 500 pcm below the Estimated Critical Rod Position (ECRP). In view of this event, the procedure seemed weak in those respects by allowing the possibility of large xenon worth errors to occur, and by not explicitly requiring ECRP recalculation prior to criticality when the ECRP was clearly in erro Nevertheless, the inspectors considered that the Shift Supervisor was responsible for the safe conduct of the startup notwithstanding that literal compliance with the reactor startup procedure permitted bringing the reactor critical anywhere below the ECRP. As noted in Procedure 40AC-9ZZ02, "Conduct of Shift Operation," at Palo Verde 1:

"Procedures are based on normally expected conditions and may not provide guidance for all conditions which may be

. ._ _ _ _ _ __ _ -_

.

'

-

.

encountered. The intent of each procedure is to ensure that

. . .the requirements of Technical Specifications are me The Shift Supervisor has the onshift responsibility for ensuring proper use of procedures and determining the need for changes or temporary procedures . . .

Technical Specifications' requirements take precedence over all procedures."

In this instance, Technical Specification 3.1.1.2 and 3.1. established acceptable rod positions below which the reactor was not to be operated, and the Shift Supervisor allowed criticality to occur outside of those specifications, the Transient Insertion Limits (also known as Power Dependent Insertion Limits, or PDIL), by not requiring recalculation of the ECC when it was obviously seriously in erro The occurrence of reactor criticality with the CEAs below the Transient Insertion' Limits is an apparent violation of Technical Specification 3.0.4 as applied to 3.1.1.2 and 3.1. This apparent violation was not discussed in the PTR b. The operators did not observe several precautions concerning criticality contained in the reactor startup procedure, 410P-1ZZ0 Precaution 3.6 stated: "Criticality shall be anticipated any time CEA's are being withdrawn or boron dilution operations are being performed." This precaution was repeated in capital letters, underlined, and set off by additional lines around it prior to Step 4.3.12, the step requiring withdrawal of the CEA Regulating Group Step 4.3.22.1 required the operator to "Continue Regulating group withdrawal until the reactor is slightly supercritical, approximately .2 dpm SUR." Step 4.3.14 requires the operator to

"Countinue (sic) to withdraw the Regulating Group CEA's in 30 inch increments as described in step 4.3.12 to the CEA Lower Limit (500 PCM below the ECRP) or until the reactor is critical WHICHEVER OCCURS FIRST."

During the interviews, some licensee personnel, including the Shift Supervisor, emphasized that the reactor startup procedure had been followed in a verbatim compliance sequence, and that since Step 4.3.12, which withdrew CEAs in thirty-inch increments to the Transient Insertion Limit of 60 inches withdrawn on RG 3, was the step being performed, the direction in Step 4.3.14 and 4.3.22.1 had not come into forc The inspectors rejected this interpretation, as did the primary reactor operator conducting the startup. He stated that he clearly understood the intent of the startup procedure to be to reduce the duration of CEA movement as criticality became imminen The licensee's procedure, Conduct of Shif t Operations, 40AC-9ZZ02, Revision 8, stated that:

Procedures are normally performed in the order as writte However, strict performance in the order written is not required unless specifically stated in the procedure. The Shift Supervisor / Assistant Shift Supervisor may delay,

. . .- .._

..

' *

.

resequence, delete or modify steps as necessary to achieve the procedure objectives and accommodate equipment outages or plant conditions which may not be considered by the procedure . ..

A, step may be resequenced if'it is independent of a step which is being delayed. . .

The inspectors noted that the action to be taken upon the occurrence of reactor criticality was independent in the procedure from the withdrawal of CEAs past the RG 3 at 60 inches position. .The operators demonstrated this understanding of procedural flexibility in initialling Step 4.3.15.1 (deenergizing startup channels) as completed when it occurred during the startup, prior to completion of the steps intervening between it and Step 4.3.1 Finally, th reconstructed chronology and the PTRR both clearly indicated that the operators did not withdraw CEAs in fixed 30-inch increments as it became apparent that criticality was imminent, as literally required by Step 4.3.12, but inconsistent with Steps 4.3.14 and 4.3.21 quoted abov The inspectors concluded that the failure of the Primary Reactor Operator and the Control Room Supervisor to expect criticality and stabilize the reactor in a slightly supercritical condition was an apparent violation of the reactor startup procedure, 410P-1ZZ03 and Technical Specification 6.8.1.a. This apparent violation was not discussed in the PTRR.

,

c. The inspectors determined that the action required by the Technical l Specifications when critical outside of the Transient Insertion l Limits had not been take Technical SpecificaLico 3.1.1.2.a j requires that with the shutdown margin less than 6.5 % at normal l

operating temperature and the reactor critical, the operators must

"immediately initiate and continue boration at greater than or equal to 26 gpm ... of a solution equal to or greater than 4000 ppm baron I until the shutdown margin is restored." The specification further states that with the reactor critical, the authorized method to determine whether or not adequate shutdown margin exists is to verify that all CEAs are within the Transient Insertion Limits (PDIL). The failure to immediately borate as required by the l Technical Specifications is an apparent violatio The PTRR did not l discuss this operator oversight.

l l The inspectors questioned the operators concerning their actions l once RG 3 had been withdrawn to 60 inche The Reactor Operator

! stated that he recognized the reactor was critical at this position, with a startup rate of "about .4 dpm." The Control Room Supervisor stated that he recognized the reactor was critical, instructed the reactor operator to insert RG 3 to maintain reactor power less than

,

10 3% reactor power, advised the Shift Supervisor that the reactor l had "gone critical below the PDIL," and recommenced to the Shift Supervisor that RG 3 CEAs be fully inserted, a known subcritical positio The Shift Technical Advisor stated that he heard the Control Room Supervisor essentially say that, "I probably violated

.

'

,

the PDIL when I put Group 3 in." The Shift Supervisor stated that

"criticality had not been declared, so I did not realize I was in violation of PDILs," and that his impression at the time was that the reactor was "very nearly critical" with reactor power at 10-3%

powe Finally, the primary reactor operator stated that as he was initially inserting CEAs below the 60 inch PDIL to level reactor power below 10-3%, his hand was slapped off of the control switch by the Control Room Supervisor. When the reactor operator pointed out that power had increased to nearly 10-3%, the Control Room Supervisor then instructed the operator to insert RG 3 fully, and the Reactor Operator resumed his action This statement was consistent with the NRC reconstructed CEA movement The inspectors interpreted this sequence as an indication that the Control Room Supervisor knew that the reactor was critical and that insertion of CEAs below the RG 3 60 inch position was not permitted when critical. The inspectors also considered that slapping the operator's hand off the control switch, if it occurred, appeared to be a poor supervisory techniqu The inspectors asked the Control Room Supervisor and Shift Supervisor why they had not emergency borated the reactor. In explanation, both operators questioned stated that they considered inserting CEAs to be a more conservative action, by shutting down the resctor, and a more rapidly effective action as well, due to the slower impact of boron injectio The inspectors noted that inserting CEAs did not preclude boratio Furthermore, neither operator considered the specification cited to be :pplicable since they believed adequate "shutdown margin" existed by virtue of a shutdown margin calculation done earlier on the shif t prior to the startup. The inspectors stated that this was an incorrect understanding of the specificatio The inspectors also reviewed Procedure 72ST-1RX09, Shutdown Margin, and a calculation done after the event (5/25/88) using the procedur This procedure used inputs of burnup, temperature, boron concentration, estimated xenon concentration, and a Core Data Book prediction of the minimum acceptable boron required to ensure adequate shutdown margin in Modes 3, 4, and 5. The procedure explicitly stated that it was applicable in Modes 1 and 2 only with an inoperable CEA, and thus was not an approved method of assuring adequate shutdown margin existed once the reactor was critical during the startup of May 14, 198 This procedure was consistent with the technical specificatio In retrospect, a shutdown margin calculation dated May 25, 1988 using the licensee's method in 72ST-1RX09 indicated that, fortuitously, adequate shutdown margin (at least 6.5%) may have existed at the time ~of criticality in spite of the critical CEA position not being within the Transient Insertion Limit An independent calculation done by the inspectors using the reconstructed CEA position at criticality and the Core Data Book, _

,. .

.

'

,

-

estimated the shutdown margin at the time of the event was 9.25%

(Enclosure 5),

d. The inspectors reviewed the Control Operator, Shift Supervisor, and Shift Technical Advisor logs, as well as the personnel statements made for the PTRR after the event. Only the Shift Technical Advisor's Log, apparently written two days after the event, referred to the criticality which had occurre In his interview, the: Shift Technical Advisor provided his log of

~

the startup which clearly stated that "reactor taken critical at ~

grp. 3 @ 50" ",as a 3:15 a.m. entr The Shift Technical Advisor initially stated.that this log had been created as the events occurred, but on the following day, he changed his recollection to state that his log from 2:00 a.m. until the end of,his shift had, perhaps, not been completed until May 16, 1988, when he returned to -

the site after his shift on May 14, 1988. The log did not indicate that these entries had been delayed, the normal practice at the facilit The inspectors reviewed the licensee's procedure for control of records of facility operation, 40AC-9ZZ02, "Conduct of Shift Operations." This procedure required that the Shift Supervisor's log, the Unit Log, "shall be maintained by the on-shift SS. This log is intended as a broad overview of the shift activities and events relevant to the safe, efficient operation of the unit . .

[and of] actions taken by the Control Aoom Operators that are significant or unusual . . . " The inspectors concluded that the failure to log the criticality event by the Primary Reactor Operator and the Shift Supervisor was an apparent violation of the procedural requirements, 10 CFR 50.9/a), and Technical Specification 6. 8.1. a . The PTRR excused this omission, out PTRR Supplement 1 /

Revision 1 did note it to be an erro The inspectors also noted that none of the personnel statements made by the operators or by the Shift Technical Advisor stated that the reactor had been critical below the Transient Insertion Limit The Shift Technical Advisor's statement was the only one which provided any detail concerning the conduct of the startu The Primary Reactor Operator, Control Room Supervisor, and Shif t Supervisor statements were similar to one another and did not indicate that there had been a transient which had occurred prior to the trip, including the reactor criticalit During the interviews, none of these personnel could explain to the inspectors why their statements did not follow the direction given on the statement form used:

"Your statement should include Unit conditions prior to the event, what indications you noted that a problem existed, your actions as a result of those indications, noted equipment malfunctions or inadequacies and noted procedural deficiencies. Include any information, no matter how

_ _ _ _ _ _ _ _ _ _ - _ - _ _ _ _

,e

' '

.

seemingly unimportant which might be important to review of this event as well as actions you recommend to avoid recurrence, if an The inspectors also reviewed the licensee's reporting of the event to the NRC. A timely four-hour, non-emergency report of the reactor trip was made by the licensee as required by 10 CFR 50.72(b)(2)(ii).

This report did not mention that criticality had occurred outside of the Transient Insertion Limit Rather it stated that the ECC had been noticed to be in error while conducting the startup, and a reactor trip had occurred as a result of inserting CEAs to permit the ECC to be recalculated, implying that the CEAs had been inserted prior to criticalit No followup notifications were made to this repor The report was drafted by a compliance engineer who arrived after the event and gathered information to make it from the operating cre The report was reviewed by the Shift Technical Advisor and by the Shift Supervisor, neither of whom clarified i The inspectors concluded that a one-hour non-emergency report was aprropriate under 10 CFR 50.72 (b) (1) (i) (a) for the criticality event below the Transient Insertion Limi The inspector's based this conclusion on the fact that a shutdown of the plant had been initiated as effectively required by Technical Specification 3.1. in this situatio Specifically, when the reactor was brought critical below the Transient Insertion Limit, that specification required immediate boration to restore shutdown margin, which implied reactor shutdown given the operator's action to insert RG 3 at the same time. Moreover, the occurrence of criticality below the Transient Insertion Limits was not a condition addressed by the plant's emergency or operating procedure Finally, on the morning of May 14, 1988, at approximately 8:00 a.m.,

plant managers and supervisors convened at the site to review the event. When interviewed, these personnel stated that they were aware that the reactor had indeed gone critical during the event.

l Even so, the licensee submitted no formal update of the original four-hour report. .NRC personnel were contacted later in the l afternoon, and definitely became aware that criticality had probably l

occurred around 5 p.m. that afternooon.

L

,

The failure to properly report the criticality event to the NRC and

! to update the report which had been made as plant managers became aware of the event on the morning of May 14, 1988 is an apparent

,

violatio The PTRR did not mention this error, but the Supplement l 1 / Revision 1 noted i . Review of Operator Training Associated with the Event The training received by operators in general and the crew involved with the May 14, 1988, criticality event were reviewed with the training department personnel noted in paragraph 1. Specifically reviewed were training associated with reactor startups, approach to criticality, 1/M plotting techniques, Estimated Critical Condition calculations, shutdovq m-e v --,

_ _ . - _ - - *

,.

' '

margin calculations, and the influence of various core / plant changes (i.e., Xenon and temperature) on ECC and shutdown margin calculation These subjects, which were'related to the event of May.14, 1988, were covered during the requalification training conducted from October to November, 1987. .The operators associated with the event in_ question completed this training and were evaluated as satisfactory. 'The licensee training staff noted no generic problems in these area During a November-December 1987 INP0 training visit, INPO requested and observed the conduct of licensee simulator drills on premature criticality event Two crews were observed, neither of which involved any of the operators present during the even However, neither drill involved criticality below the PDI In summary, the only deficiency observed involved with the presentation and emphasis of subjects related to premature criticality events was that the specific condition of criticality below the PDIL was not formally addresse In view of the otherwise complete presentation of subjects associated with this event, this deficiency is focused specifically upon the required actions if criticality occurred below the PDIL defined by-Technical Specification 3.1. The training instructors indicated that when this question was raised during simelator sessions, the operators were generally unaware of the applicability of the Shutdown Margin requirements of Technical Specification 3.1.1.2, focusing instead on the PDIL Specification 3.1. Disagreements existed among both the operators and the training staff as to how 3.1.1.2 should be interpreted and applied under conditions similar to the event in que.; tio Clarification of the relationship between 3.1.1.2 and 3.1.3.6 was not mad In summary, the single training deficiency regarding the proper application of Technical Specification 3.1.1.2 was significant because confusion or disagreement over its proper interpretation had been previously notsd, but management had not acted to clarify i . Exit Meeting (30703)

The inspectors and a representative of the NRC Office of Investigations met with licensee representatives (noted in Paragraph 1) on June 10, 1988, after all but one interview had been complete (That interview l was completed on June 24, 1988 and did not change the overall results of the inspection). The scope and a general outline of the results of the inspection activities described in this report were presente Licensee representatives acknowledged the information presented.

l l

l l

._ _

. . ,

,..

'

'

.

'

14.

I f ENCLOSURE 1 Control Room Log Unit 1, Arizona Nuclear Power Project (ANPP). Unit 1 PTRR 1-88-003, ANPP Unit 1 PTRR 1-88-003 Revision.1, Procedure 410P-1ZZO3,"Reactor Startup,"

Procedure 72ST-1RX09, "Shutdown Margin,"

ANPP Core Data Book, Unit 1 Cycle,2, Interviews of ANPP personnel associated with the-event, Shif t ' Supervisor's Log, Shift Technical Advisor's Log, and Calculation NA-PV1-C02-87-54-00, "Response to EER-87-RX-019,

"UIC2 XE-0AP Tables and Coefficients""

l l

l l

1'

=

- ... . . . . - . -

j!

1jIii}];I

-

1 -

.

-

_-

.

g C

.

- ., . _

_

- -

-

J .. _ _ -

6.g.'p _ 4 3 t

- - - _ g9 0 0 _

0 0 1 - f

!

"

i ' - _

- !

! l g -

ijgf

X

-

'

T b -

_- -

.

(? 2 a

Pc -

_

_ _

.

-

-

- .g?

M Ku

-

-

m cI /

/

.'

.

.

- _ -

. ii -

-

1 aW g% .-

E R

U e e-

_

- n -

I G% , i F

sf

-

.

I

-

- -

! e- ' 4 n 3

?

t 9l y

,

Y t ii. R ,4

_ _

/li

. ,

!

}[

- .

.

cijI yL

.

-

.

i d 7 y

>

,

'

x_ ,

a

-

._

.

.

i

-

-

-

J>%#N - \

_

_

_

_

_ -

.

/ hy'

-

_

_

,

c = .

-

e 4 V

u e

B 7

-

-

_

_

, i . . li - .

_ i m f .

i

-

i f

A

!

-

4/ ;N

_

_

~

~

~ iM

[

_

.

$=..

-

a 3 a

-

g t

-

_

Q

_

3

_

u ~

, J 3 j

-

,, 1 ;J 0

~

-

-

= - .k

,l

.

_j i

'X j 2

1. _;;i\

-

-

p- Q J L

. . _ _

7.-

• 1 -

1 Enclosure 2 G,raphical Analysis t = Time of reactor trip = 3:35:49 (identified by prompt drop @ t *

0 0 t1 = Middle of CB3 wait @ 30" s t - 10:39 (graphically) = 3:25:10

(graphically)

= 3:24:32 (alarm typer)

tg = Middle of CB3 wait 9 45" = t0 - 6:16 (graphically) = 3:29:33 (graphically)

= 3:28:42 (alarm typer) .

- 55 sec t4 = Approximate critical position on(graphically) rod insertion s t=3:3k:54(graphically)

= 3:34:36 (clarm typer, 47")

t = The estimated critical position on rod withdrawal at 47" on CB3

correlates to an alarm typer reconstructed time (from time rods estimated to have been at 47") of 3:30:17. Graphically,thiscgrrespondsclosely to the power level @ the 40.5" CB3 position (21.510 % power).

Graphical Assumptions: All points marked from center of trac Scale:

1 min, to 1.1 m . . , _ . . _ . _ , . _ _ . _ _ _ . . . . - .

.. - .

, ..

.,

' '

,

-

Enclosure 3 Reg CEA Speed Assumed = 30"/ min

= .5"/sec

,

from ANPP Training Material Regulating CP1 Pull (P)/ - Estimated Start Insert (I) Wait Position Position Time Duration Duration Before After

.

3:04:27 1:03 P(31.5") :03 0 -

31.5" 3:05:33 :01 P(.5") :05 31.5 - 32" 3:05:39 :01 P(.5") 2:05 32.0 - 32.5" 3:07:45 1:05 P(32.5") 1:40 32.5 - 65.0" 3:10:27 1:01 P(30.5") 1:04 65.0 - 95.5" 3:12:32 1:04 P(32") 1:18 95.5 - 127.5" GP2 withdrawal starts 3:14:54 :51 P(25.5") USL 127.5- 153.0" @ 3:12:43 Regulating GP2 3:12:43 :53 P(26.5") 1:18 0 -

26.5" 3:14:54 1:13 P(36.5") :05 26.5 - 63.0" 3:16:12 :01 P(.5") 4:21 63.0 - 63.5" 3:20:34 1:03 P(31.5") 1:50 63.5 - 95" 3:23:27 1:05 P(32.5) 2:15 95 -

127.5" GP3 withdrawal starts 3:26:47 :34 P(17") 2:42 127.5- 144.5" @ 3:23:37 3:30:03 :19 P(9.5") USL 144.5- 15 :34:28 :06 I(3") :01 3:34:35 :09 I(4.5") :07 3:34:49 :01 I(.5") :11 3:35:01 :11 I(5. 5") :04 3:35:16 :33 I(16.5") RxTrip Reactor trip at 3:35:49 confirmed time Regulating Group 3 3:23:37 :55 P(27.5") 2:23 0 -

27.5" 3:26:55 :26 P(13") 2:42 27.5 - 40.5" 3:30:03 :22 P(11") :01 40.5 - 51.5" 3:30:26 :18 P(9") :04 51.5 - 60.5" 3:30:48 :02 P(1") 2:39 60.5 - 61.5" 3:33:29 :03 I(1.5") :30 61.5 - 60" 3:34:02 :13 I(6. 5") :08 60.0 - 53.5"

'

3:34:23 :11 I(5. 5") :01 53.5 - 48.0" 3:34:35 :07 I(3.5") :07 48.0 - 44.5" 3:34:49 :01 I(0.5") :11 44.5 - 44.0" 3:35:01 :11 I(5. 5") :04 44.0 - 38.5" 3:35:16 :33 I(16.5") Trip 38.5 - 2 :35:49 Reactor trip = t

,

n- - - ~ ,-., n , - - n-. . . < - ,,, , ,. , -, e ,,- n -

, ,- - r--- r,-

__

, .

' '

. 17

!- .

-Enclosure 4 Page 1 ECRP Calculation Assumptions:. SUR = 26 pA/(keff p), [k = 0 (no rod motion)

A = .1 (in reactivity of interest pu+100 pcm) ieff=.006 From graph, SUR a .7 dpm in period just prior to power reversal i

.7 (.006 p) = 2.6 p

.0042 = 3.3 p 127 pcm =p From Table 2.5.2 (Unit 1, cycle 2 core data book)

CEA worth @ 45" GP 3 = -1377.5

,

@ 60".GP 3 = -1226.1 l

By interpolation from SUR = .7 dpm @ 60", SUR = 0 @ 47.3" GP 3

= ECRP As a cross check, the CEA motion reconstruction / alarm typer record indicated GP 3 remained at time aboutinterval 60" forfrom 2 min 42* sec._3 As st.o13 in the expanded log power graph, the to 10_ amps is approximately 3 minutes, relatively close agreement, given the measurement difficult _ -

• ..

• ,

_

.

. .

.

'

v 'T

'

,90pm l M 200 i i I 6 200 F- -100- 8 2 u

10 0 ,

, - - - - - - i 10200M

,

n .i # i ,

,

,r

' '

10 ' i

-

t i .

10 . -

10 .._

.

l to _7 i ' _ _^

$ .- - .100 _ goo '

._ _

. _ _ _

> l100 -

- - -

100 . _+

, _

i ,

,

-'

ED10-8

.- --

. _ _ __ '_-- 10-'

'

--

'

' 10-s . _ ..;.___

~

l n_ _ __ __ __10- 1 =_

.

_ _ _ . _

.

. . _ _ ! , ,

- -

I

--

-- 10 - 8

' e 10-a i e_

'

l ---

- ' '

10-2

-

'

'_10-2, ____

-

-

]

--

_____ ::2 . _ _ _ _ _

_.-._

rw ;o-3 ,

y l j --- ' s -<'

10 3

-

-

.

Q-r

- " - -

!

-

-

,

3 .di .ri --- . _, !O - 3_ . _ _ _ _ _ _ _ .

-

._ _ _

_ ._ _ ' 10-3 --=b

_

[DIO-d .'_-- .10-d

' i i 10-4 . ' _ _= _. _ _____

- - -

i

'_10 -d. ==I = 5

,'{  ; .

_,

]- - -

-- _

' '

27," 10- 8 ,' 10-s -, ; ! ,!

'10-5 ===d

' - - -

-

, :: . q_ _-- . -. 10 -8 .__________ ___ =

.... __-- ,

_

' -

t 1

, J.192NG3nA-. ; '- [ ,!

'

! ' 4 m 'm y"rg -.

_ --y - +.10 6 m

'

'10-6 g

,' -5

,

m-l

__

,2X' 10g i j WO-a i i 10 :

2N @'~~'a'

u

• 1' L.- f j m p ENCLOSURE (l4) (P.2):

STARTUP RATE MEASUREMENT j'Gaf*

l l

l l

l l

I

.

'

E n q g 'i r i-. .

< .c . <

.

,

c

...

.-o*

.

'

.- 18 Enclosure 5 -

~

Shutdown margin calculation @ 565'F, BDC, 0% powe PLCEA ignored; Boron assumed 1033 ppm

.

Assuming critical @ 47.3" on GP3 Total inserted CEA worth = 15.0% = 15.10-2 = 15,000 pcm

-

worst stuck rod = 4.43% = 4,400 pc ~ rods (GP 3,4,5).already inserted = 1355 pcm shutdown margin: -9245 pcm~@ 565' !

i

-

-

!

l

!

4 I'

i-

_

q .p. . f .; -r +.w n.mg9.MQ4.3..fis.l%i;Q.A.Qi %. O.,-Mp )&. Vh.. : y

. .

.. 4 . m -...-. _._ . ,.. 4 l.-.; __. % ,s.. ? (.. . m .

'

.

$Y,y... w .. w . p ,,..p.._ ,,.

-

'^h..:

.

..

3.. . 4.;.

.

.. .

.

ENCLOSURE-(6 D STARTUP CHANN il ~ 1, ATE"JATA AND STRf f'-C"ART ll; s

__ =- -10 125- CH^arasis, 5 e

.

- 04

.

m.y o u t o i, 10 -- _-

=

~-

.a.; -

F 3I

, _

^

, =

-

_. -

\ . .

'

=m =- : < 4

.

,- m s

.

i t .

=

=

=

m - - - -

10_ __. ._--- i

.

. ~&~ ,4 -

.0- _,0-

.

. _ , . --_

,w__

--

, _

-

-_,~.v.+,,

_

,=

,

-

.". -- . . _

. .. .---.---. f_,

=m n. - m .-- __

sv

, ,-

m

=

--

W,c :Ws

-

i - ' . - '

s=i.= - i .

= ) c

&

.

_-

=

\

,

g l L -. . _ . _

.

J .=_

-

_ _. ._

-- x 3 g

- _ . _ _

__--n --

-

10-.-- -

.

,

75- -

.- _IO =_

.-

_ Z ; --; ,

-

=

, - - -

_; ,

'

f---'

ly;

,

-

,

x -= -

l _

,

=

i Fr+-- _

10, - -

- . -- -.

!O'

.

~

-

_

,  ; . _ _ . .

-: ,,

. - . . - I

-

, .

_.-

i, l- =>-.

_ .

,

,

- -

.

. =k l

[

\ ~_: ,

10 - 25-4 . 10l _

.-.- -

- _

- x

__

-

. & z

.T 4 e 4 --

- .- g s w -

_ 10 -

= o- 10 r C C C C C C O C (. C, C C C O '

.c .:=.m.....

--

-

.. -

_(_..,........-..-.. m.....

..

.. = ,,.. c

.

..

.

-

. . .

..c...,

.

.  :

c;' c; q

., ..

. ,

' e- . . .y .

,

'L%h Wah,*.C'%t' @ f ::'f rn . p.. p$w

. . .

p s ... ,. . w 'l*9- g, .L~;...,.

= l+ v , [ .-,.,....... ' . .c .. . .: . c '-:' W. . .. - - :. :.7 ..

'

. f.' .: ~ . , t

'

N,*N s?'er_G*% 4?*?'.& -'.kw*n

',e . .M. ,. * ..am ..-- *:.~ --s t ,Lp '; .s .' .'m_.'

.

. '

.s :w. w4 . ' * .*.. w . . v%.

..- 1- '

^

s - , , , .* : -e.,- ,.~*.): ~.

'

.

.. ,':r. : .a .,,, ...t < , , v. - . . . .. . ^ : .. m , . . ..:s,h, ~

.-- . .' . 4 4 r..- u ,

.

m .

v.',n W + r i... . . .:-i , *. /.

. .

'a e - + e-e,es a,

,. ..

• "*a t .

. : - r-~c .

. .,: e

, ,L,f. . -.- * ; . ..

.

a,. sg'. f* (e - 5 . W s.#A? ' g * *. . ."..,-4d ' *

i .

,

g--e -

4, %, p>.. ,U2 .,j.

' ' . din s -

. ,, f. s* . ! e . - 6 i '.* - i :.*...-

.

,. ~ g c2 ,." L ~ -

' U..... _ %~ :r * * * ! ., - '

"

' -

~

I

'

._'.. L

. -

.

_ . _ . _ _ . . _ . , _

,. .

..

gL . m. .

we e p- .

,

1 200 l l t 200 -

a 2002 i "l  : 10 0: ._,

,

--

10 0 - ---

10 0;n;;r v

n ... , i i .

t _.,

.

, 4 i

.

..-

i i

.

_

10- -

10- -. .

\_ 4 . .

.p -

.

t l -

r

.

l i rg - l  ; .

_

.

0 j

- . - - - -

. .

O 7 C- D I '

10O .

• '

. .> _ ...

_

. . - _ . .

__

. - - _-

--

-

r i

, , ,

, .

. .

. _

i , i i 10_t

, ,

10 . __

__

___ __

_. - - -

._ _ __.10 i.2., --- [ l I

- --

' 9 l ENCL,OSURE (6) PAGE 1 0F 21

--

- - _ _ -__ - . - _ _ _ _ . _ _ . . - - _ _ . __

-

, , . _ _ _ . _ _ . _ _ _-

.,,.

.

- . c.

.

, n L' -

ENCLOSURE (6)

r

.,.

'

CHANNEL CHANNE GRP 1 30 300 284

-

60 310 309 90 357 337 ,

120- 393 381 GRP 2 60 501 449 .

90 748 670 {

120 GRP-3 30 1277 1089 CTS

!

b

i

?

f

!

,

.

I

,

i

!

t ENCLOSURE (6)

PAGE 2 0F 2

. _ _ . _ _ _ _