ML13004A323
| ML13004A323 | |
| Person / Time | |
|---|---|
| Site: | Callaway  |
| Issue date: | 05/18/2011 |
| From: | Collins E NRC Region 4 |
| To: | Lawrence Criscione, Raspa R, Virgil M NRC/OIG, NRC/RES/DRA, NRC/EDO |
| Shared Package | |
| ML130040225 | List:
|
| References | |
| FOIA/PA-2012-0259 | |
| Download: ML13004A323 (28) | |
Text
Criscione, Lawrence From: Collins, Elmo Sent: Wednesday, May 18, 2011 8:39 AM To: Criscione, Lawrence; Virgilio, M-i'in"..2ao lossana ,b7C3 CC: VnpI Antnn" Millr G*nfffraJL(b)(7)(C).Jaylor, Ib)(7)(C) V....Tyor Nick' Nc
Subject:
RE: May 27th meeting in Marty's office Thank you Larry -
I look forward to reading your article and to our discussion.
Elmo From: Criscione, Lawrence Sent: Wednesday, May 18, 2011 6:46 AM To: Collins, Elmo; Virgilio, Martin; a Ro--n Cc: Vegel, Anton; Miller, Geoffrey; (b)(7)(C) aylor, Nick I(b)(7)(C) (b)(7)(C)I
Subject:
May 27th meeting in Marty's office Elmo/Marty,
[This email is included elsewhere]
Criscione, Lawrence From: Criscione, Lawrence Sent: Wednesday, May 18,2011 7:46 AM To: Collins, Elmo; Virgilio, Martin; Rna RosNana(b)7)(C)
Cc: n n ile . ff rey; "(C) Taylor.Nick
Subject:
May 27th meeting in Marty-s office Attachments: Draft PROS article.pdf; ML1020703740 - page 5.pdf Elmo/Marty, Attached is an article I drafted for the Professional Reactor Operator Society. They have told me they intend to run it in their Fat] 2011 issue of the Communicatoralong with comments from Callaway Plant.
The article was written as a Generic Fundamentals primer on how a PWR responds to passive reactivity insertions and to detail important Operating Experience left out of Information Notice 2011-02. For that reason, it is a little tedious to read. However, the entire event is rendered in the figures and tables; what occurred that day is readily discerned by spending a dozen minutes reviewing Figure 4 and Tables I through IV. The individuals from Region IV copied on this email have supposedly investigated the incident and should be able to advise you as to whether or not statements I make in the article are an accurate assessment of what occurred.
When I originally requested to meet with Marty, it was in response to an August 13, 2010 meeting which had occurred between Adam Heflin, Bill Borchardt and Marty Virgilio in which Adam Heflin came to Rockville to "Exchange Perspectives; Confirm they are doing everything they can" with regard to the October 2003 passive reactor shutdown. I too am interested in exchanging "perspectives" and in confirming that both we and Ameren are doing everything we can; and that is the reason I originally requested to meet with the two of you. That being said, I'll discuss any topic which you wish to discuss.
The purpose of this email is to provide you the attached article which contains my perspective of the incident. If you have time to review it prior to the meeting, please do. I hope to spend our time at our meeting understanding the NRC's response to the incident and not the incident itself.
V/r, Lawrence S. Criscione Reliability & Risk Engineer RES/DRA/OEGIB Church Street Building Mail Stop 2A07 (301) 251-7603 "If responsibilityis rightfully yours, no evasion, or ignorance or possing the blame can shift the burden to someone else."
I
TAB IA Drop-in Visit Agenda August 13, 2010 INERARY TIME PERSON VISITED CONTACT PERSON PHONE William Borchardt, EDO; 1:00 p.m. - 2:00 pm, Marty VIrgIllio, DEDR, and Renee Taylor (301)415-1700 Michael Weber, DEDMRT VISITORS REPRESENTING CALLAWAY PLANT Mr. Adam C. Heflln, Senior Vice President and Chief Nuclear Officer TOPICS OF DISCUSSION (Provided by Union Electric Company)
- 2003 Reactivity Management Event of Inadvertent Passive Shutdown; Exchange Perspectives; Confirm they are doing everything they can 0 Mitigating System Performance Index (MSPI) Emergency AC Power 9 Refuel 17 Control Rod Issue 0 Safety System Functional Failures (SSFF) 9 Security Rule (Physical and Cyber)
- Callaway Plant, Unit 1 Plant Performance 0 New Plant Status OFFICL~L UBE ONLY ~EieBITr:E INTERItA~. INFORMA7IOfl
Analysis of the October 21, 2003 Passive Reactor Shutdown at Callaway Plant Submitted by Lawrence S. Criscione, PE Lany Criscione works in the Nuclear Regulatory Commission's Office of Research (RES) where he analyzes equipment and human performance data in support of nuclearregulatoryresearch.
The views expressed in this article are his own and in no way reflect the position of the US NRC. Larry worked at Callaway Plant from 2002 through 2007 where he was a licensed Senior Reactor Operator and a Shift Technical Advisor. Larry has worked at Clinton Power Station (2000-02) and FirstEnergy (2008-09). In the US Navy he was qualified as Engineering Officer of the Watch at DIG prototype (1994) and aboard the fleet ballistic missile submarine USS GEORGIA (1995-98). He holds a branch license in nuclear engineering from the State of Iowa.
He is a 1993 graduateof the University of Missouri-Rolla.
Abstract: At Callaway Plant on October 21, highlights the pitfalls associated with 2003, while attempting to stabilize reactor attempting to maintain a commercial power during a forced de-rate, Xenon-135 pressurized water reactor critical during buildup caused average reactor coolant MODE 2-Descending and demonstrates how temperature to lower at -0.4gF/rmin for a 25 concepts tested on the NRC Generic minute period resulting in an automatic Fundamentals Exam apply to actual reactor isolation of the letdown system on low operation. The incident also highlights some pressurizer water level and operation of the non-conservative reactivity management reactor below the Minimum Temperature for practices which must be avoided by Critical Operation. After manually tripping the Professional Reactor Operators.
turbine-generator to assist in temperature recovery, the reactor passively shut down This article describes the events leading up to due to a sharp 4°F rise in average coolant and immediately following a passive reactor temperature. For the next 110 minutes the shutdown which occurred at Ameren operators performed secondary and tertiary Corporation's nuclear plant in Callaway plant shutdown activities while relying on an County, MO on October 21, 2003. An informal estimation that Xenon-135 levels assessment of the NRC's response to the were sufficient to prevent the reactor from incident is included along with key "lessons to inadvertently restarting. The passive reactor be learned". Details of the incident were first shutdown was not documented until it was publically released by the Union of uncovered 40 months later, and it was not Concerned Scientists (UCS) in a 2010 issue shared with the Institute of Nuclear Power brief1 titled 2003 Segmented Shutdown at Operations following the request which Callaway, and then, in 2011, the US Nuclear accompanied SOER 07-1. The incident Regulatory Commission (NRC) partially I (p!V~~~Ci.~.r'ftcerPo0M:er/nUChx0I- J)Mer _isk.isa 1C1IV.;200" S3-scu11CIIe-sh L11 kown -ai~al IIwa V JtIItI I
covered the incident as part of Information Item 2 is normally present throughout the fuel Notice 2011-02, Operator Performance cycle at most PWRs; however, some plants Issues Involving Reactivity Management at do permit a slight +MTC during a limited 2
Nuclear Power Plants. window of their fuel cycle. October 21, 2003 was late in fuel cycle 13 for Callaway Plant Also discussed in the article are: and a -MTC was present so discussions in this article assume a -MTC.
" The manner by which the effect of Xenon-135 buildup can be masked by The combined result of items 1 and 2 is that other passive reactivity insertions on a US commercial PWR, power is during a plant transient inherently stable. That is, the reactor "wants"
- The effect Non-Fission Heat Rate has to stay at a steady power and resists power on Temperature-Reactivity feedback increases and decreases.
when operating near the Point of Adding Heat (POAH) Response to a reactivity insertion with
" The challenges facing the operator steady state steam demand: When during low power operation due to negative reactivity (Ap) is inserted (e.g.
human factoring of control board insertion of control rods, addition of boron, instruments buildup of Xenon-135) while the steam demand (i.e. turbine-generator loading) is REACTOR DYNAMICS REFRESHER held constant, reactor power will decrease slightly. Because of the negative power Passive Response to Reactivity Changes coefficient of reactivity, positive reactivity is passively inserted as power lowers, and this Commercial Pressurized Water Reactors dampens the negative reactivity insertion.
(PWRs) in the United States are designed to With steam demand unchanged, the new passively respond to changes in reactivity. lower power will cause a negative power They do this through two primary methods: 3 mismatch to develop.4 This negative power mismatch will cause temperature to lower.
- 1. A negative power coefficient of Due to the -MTC, as temperature lowers reactivity positive reactivity is passively inserted which
- 2. A negative Moderator Temperature further dampens the negative reactivity Coefficient of reactivity (-MTC) insertion.
Item I is a required safety feature of all US Temperature will continue to lower as long as Commercial designs: a negative power there is a negative power mismatch.
coefficient of reactivity ensures that an Eventually, enough positive reactivity will be uncontrolled rise in reactor power will result in inserted by the temperature drop to result in a a negative insertion of reactivity, thereby net increase in reactivity. This point is called limiting the power rise. the point of power "turning". At this 3
Since Callaway Plant is a PWR, the reactivity coefficient due to voids is minor and is not discussed in this article.
4 Power mismatch is the difference between steam demand and reactor power 2
Average Reactor Coolant Temperature (Tavg), Control Band 'D' Rod Heights and Reactor Power (AT) during the October 21, 2003 Passive Reactor Shutdown at Callaway Plant 09:20 09:30 09:40 09:50 10:00 10:10 10:20 10:30 587
- i.... ... . . . .. . . . . . . . ....
7F . ------- -------------- ------------- - --
578*F Y *------*--.-.-..-] ! {560'F 575'F - " 557*F 572: 4...... ... --.... .... o 569*F V 216 . ....
5601T 557'F 554F 551" F 600 80 0:00 1:00 2:00 3:00 4:00 5:00 6:00 7:00 8:00 9:00 10:00 11:00 12:00 13:00
- Tavg (scale: 3F/division, maximum: 586.7F, minimum: 549.9'F)
-CTRL ROD BANK D (scale: 20 steps/div, max: 216 steps, min: 0 steps)
AT power (scale: 10% rated reactor power/div, max: 100.9%, min: 1.6%)
- - -- 20 or 40 gallon additions of boron (220 gallons during first 2% hours)
Figure 1: Plot of Average Coolant Temperature (T.,,), Primary Calorimetric power (AT) and Control Bank 'D' rod heights during the October 21, 2003 down power and passive reactor shutdown. Note the severe temperature transient which began at 09:36 (see inset plot in upper right comer of the graph). Turbine first stage steam pressure data (not shown) indicates that the operators stopped lowering turbine-generator loading at 09:36 with reactor power at 9%. Over the next three minutes, negative reactivity due to Xenon-]35 caused power to continue to lower another 1%. The power mismatch between the steam demanded by the turbine throttle setpoint and the power being produced by fission caused T,,, to immediately begin to lower, thereby inserting positive reactivity which countered the negative reactivity being inserted by the continual buildup of Xenon-]35, Around 09:39 the positive reactivity being inserted by the lowering temperature matched the negative reactivity being inserted by Xenon-135 causing reactor power (as indicated by core AT) to stabilize at approximately 8%. With a I% power mismatch present, over the next twenty minutes Tv, continued to steadily lower and thereby counteract the continual buildup of xenon.
Shortly after 10:00 the crew began to again lower turbine-generator loading in response to the Shift Manager's decision to take the turbine off-line following the letdown isolation. The renewed lowering of generator loading caused steam demand to lower below fission power and thereby allowed Tvg to temporarily recover slightly.
During this time period (10:03 to 10:09), the negative reactivity being inserted by Xenon-135 was now being counteracted by the positive reactivity being inserted by the load decrease (the plant had a negative power coefficient of reactivity). Generator loading was again stabilized around 10:09 causing T.,, to resume falling, which is the expected passive response of the reactor plant to Xenon-135 buildup. The operators failed to grasp the reactor dynamics behind the transient and assumed the 10°F drop in T., was being caused by malfunctioning steam line and turbine drain valves (see page 2 of the Enclosure to Retfrence 8 and pages 9 and 10 of Reference 9).
3
point, reactor power will start to rise and the results in the same steady state power at a magnitude of the negative power mismatch new temperature. This generic fundamental will lower, dampening the rate of the is demonstrated later in this article by the way temperature drop. the reactor at Callaway Plant responded to Xenon-135 buildup when the turbine-Once reactor power rises above steam generator loading was kept constant from demand, there will be a positive power 09:36 to 10:03 (see Figure 1).
mismatch which will now cause temperature to rise. The rising temperature will insert Passive response to a change in steam negative reactivity, causing reactor power to demand (for a PWR): When the steam lower. These passive feedback processes demanded by the turbine is lowered, a will continue until eventually reactor power negative power mismatch will result, causing again matches steam demand and there is no temperature to rise. The rising temperature power mismatch to drive temperature. At this will insert negative reactivity, causing reactor point, temperature will be lower than it was power to lower. The lowering reactor power prior to the negative reactivity insertion. will result in a lowering of the power Mathematically, the change in temperature is: mismatch, dampening the temperature rise.
AT = Ap/(-MTC). As long as there is a positive power mismatch, temperature will continue to rise.
The reactor will passively respond to a The negative reactivity insertion from rising positive insertion of reactivity in a similar temperature will continue until reactor power manner, resulting in the reactor operating at a falls below steam demand resulting in a higher temperature than prior to the reactivity negative power mismatch which thereby insertion. causes temperature to lower. The lowering temperature will insert positive reactivity, The response of the reactor described in the causing reactor power to turn and approach paragraphs above is called "Temperature- steam demand. Reactor power eventually Reactivity feedback". Temperature-Reactivity will become steady at the new steam demand feedback consists of two things: level. Due to the negative power coefficient of reactivity, the lower power level will have
- 1. The passive response of the average resulted in a passive positive reactivity reactor coolant temperature (T,,,) to insertion. Temperature will passively respond the power mismatch induced by the to this positive reactivity insertion by change in reactivity steadying out at a higher level and thus
- 2. The passive counter insertion of inducing a negative reactivity insertion which reactivity due to the temperature cancels out the power defect.5 response, which continues until power turns and re-approaches steam A pressurized water reactor will respond demand. similarly to an increase in steam demand.
So, without any operator action, US The response of the reactor described in the commercial PWRs passively respond to paragraphs above is characterized as reactivity changes in a manner that eventually "reactor power follows steam demand".
5 power derect is the term for the reactivity inserted from a change in reactor power level 4
Logarithmic Plots of Total Power (AT) and Fission Power (IRNI) during the October 21, 2003 Downpower and Passive Reactor Shutdown 0:00 1:00 2:00 3:00 4:00 5:00 6:00 7:00 8:00 9:00 10:00 11:00 12:00 13:00 100 - 5.2E-04 10 IRNI channel I (ion charnber amips), 5.2E-05 5.2E-06 0.15.2E-07 SI I IRNI 10:12 10:14 10:16 10:18 10:20 10:22 10:24 10:26 10:28 IE-5 5.2E-08 2.8E-6 5,2E-09
- - %. i IRNII
.2.8E-7 5.2E-10
- 5.2E-12 Figure 2: Logarithmic plots of Total Power (as represented by AT instrument readings) and fission power (as represented by Intermediate Range Nuclear Instrument currents). Note the offset which developed between 00:00 and 10:00 as IRNI currents lowered slightly more than core delta temperatures in response to the down power. Part of this offset is due to an actual divergence and part is due to indication limitations. During the downpower, the programmed lowering of average coolant temperature affects neutron leakage and thereby the neutron signal reaching the IRNIs; this causes indicated fission power (e.g. IRNI currents) to lower more than actual fission power.
Also during the down power the weighted half-life length of the fission product inventory increases; this slightly buffers total power but does not affect fission power. Because of the offset developed by these effects, IRNI instruments cannot be scaled to give an accurate thermal power level. However, this does not prevent them from performing their primary task of indicating relative changes in fission rate across several decades of power during relatively short time frames (i.e. several to dozens of minutes). The inset graph displays the departure of total power and fission power as the Non-Fission Heat Rate (NFHR) and Point of Adding Heat (POAH) are approached, 5
So without any operator action, US PWRs Pumps), this article is primarily concerned passively respond to steam demand changes with the effect of decay heat. The NFHR is in a manner that eventually results in reactor about 7% of rated power when the reactor is power matching steam demand at a new operating at 100% power. The contribution of temperature. This generic fundamental is short-lived fission product daughters to the demonstrated later in this article by the way NFHR is roughly proportional to the fission the reactor at Callaway Plant responded to rate so it lowers proportionally to reactor the lowering of turbine-generator loading power. However, the change in the between 10:03 and 10:10 (see Figure 1). population of long-lived fission product daughters lags the change in fission rate as The Effect of Decay Heat the reactor is down powered. As the fission rate falls to zero, there is still a substantial Following the initial criticality of the fuel cycle, amount of heat being generated by the long some level of decay heat is always present. lived fission product daughters. This NFHR The amount of decay heat present is varies with power history, but, following a determined by the reactor's power history. At 10%/hour shutdown of the reactor, the half-100% rated power, decay heat typically life spectrum of the remaining daughters is accounts for 7% of the power being long enough that the NFHR is relatively generated in the core. During a down power, constant when measured in hours (i.e. it decay heat accounts for a slightly larger lowers by just a few percent every hour).
percentage of reactor power than at steady state power. This is because the longer lived By the time the reactor at Callaway Plant fission product daughters which were passively shut down on October 21, 2003, the produced at 100% power are exerting a NFHR was 1.75% of rated reactor power.
disproportional influence on the decay heat About half of this was due to RCP pump heat.
spectrum than they normally would at a steady state power level. This influence is The Point of Adding Heat: The NFHR not easily noticed in MODE 1, 6 However, as determines the reactor's Point of Adding Heat reactor power nears MODE 2,7 the effects of (POAH). The POAH is the amount of fission decay heat become substantial. power needed to noticeably affect reactor power. During a reactor startup, the POAH is The Non-Fission Heat Rate: The Non- the point at which raising reactor power (as Fission Heat Rate (NFHR) is the power measured by the nuclear instruments 8) will produced by the reactor plant from sources noticeably affect total power (as measured by other than fission. Although there are other the calorimetric Instruments 9 ). The POAH is contributors to the NFHR besides decay heat significant during a reactor startup because it (e.g. friction heat from the Reactor Coolant is the point at which Temperature-Reactivity 6
7MODE I refers to the state of operating the reactor at power (5% to 100% rated reactor power).
MODE 2 refers to the transition state between the reactor being solidly in the power range (i.e. beyond the point at which the NFHR exerts any substantial influence) and the reactor being shutdown (i.e. definitively subcritical as indicated by calculating K~f-to be less than 0.99). The reactor enters MODE 2-Descending when reactor power lowers below 5% rated power.
8 There are three sets of nuclear instruments (the power range, intermediate range and source range). The nuclear instruments measure fission rate by detecting stray neutrons produced by fission.
9 There are two sets of calorimetric instruments at Callaway Plant: AT instruments (primary calorimetric calculated from the temperature rise across the core) and thermal output computer points (calculated from a secondary calorimetric).
6
feedback starts to occur: once reactor power related inverter (NN11) failed, causing the ascends above the POAH, it becomes difficult unit to enter a 24-hour Technical for the reactor operator to pull control rods to Specification (T/S 3.8.7.A) to either repair the produce a set Start Up Rate (SUR) because failed inverter or begin a plant shutdown.
as positive reactivity is actively inserted with the control rods the resultant reactor power At 00:37 on October 21, 2003, after repair increase causes temperature to rise and attempts by Electrical Maintenance, the thereby feed back negative reactivity which operators placed the inverter in service for a lowers the SUR. Prior to reaching the POAH, retest. The inverter failed its retest and at the reactor operator uses the control rods to 01:00 the operators began down powering actively control reactivity. Beyond the POAH, the reactor at 10%/hour in preparation for a the control rods are used to actively control reactor shutdown.
average coolant temperature via the passive response that temperature has to manual By 07:21 reactor power was just below 40%
reactivity changes. with the inverter still unrepaired so the unit entered the 6-hour Technical Specification On a shutdown, the POAH cannot be (T/S 3.8.7.B) to either repair the failed recognized until the reactor is already below inverter or shut down the reactor.
it. During a shutdown, the POAH is the point at which lowering fission power (as indicated Entry into Off-Normal Procedure for Loss by the Intermediate Range Nuclear of Safety-Related InstrumentPower Instruments) has no effect on total power.
This generic fundamental is demonstrated on At 08:21 the inverter was again placed in Figure 2 by the way the AT trace steadies out service for a retest. The inverter failed its at 1.75% while the IRNI trace continues to retest and the crew responded by performing lower. the off-normal procedure for a "Loss of Safety Related Instrument Power". By 08:36 the EVENT NARRATIVE DESCRIPTION control room operators had completed their actions, but the off-normal procedure could Cause of the Forced De-Rate not be closed until an equipment operator could become available to perform an At 07:21 on October 20, 2003 a safety- alignment check of some valves in the Table 1: Noteworthy Activities Performed prior to Securing the Downpower The "mark" column refers to the letter on Figure 4 which marks the activity/milestone in relation to the plant conditions which were present and the other activities performed.
mark time Activity/Milestone A 08:17 Cooling Tower Blowdown secured to support Chemistry evolutions.
Inverter NNI I retested and failed. Crew enters off-normal procedure for "Loss of Safety B 08:21 Related Instrument Bus". The dip in Tavg on the graph of Figure 4 is due to the momentary opening of a Steam Generator Atmospheric Steam Dump when NNI I failed.
Control Room actions for "Loss of Safety Related Instrument Bus" complete except for an C 03 auxiliary feedwater valve line up surveillance assigned to the Equipment Operators.
7
Auxiliary Feedwater system. This alignment significant, it was not great enough to check was not completed until 11:34, overcome the large amounts of positive resulting in the off-normal procedure reactivity being inserted by the 10%/hour remaining open until 11:37. Although this off- lowering of reactor power and the 3°F/hour normal procedure administratively remaining lowering of reactor coolant temperature. In open should not, in and of itself, have caused fact, prior to 09:36 the operators were a problem, for unexplained reasons the occasionally having to actively insert negative operators claim they could not perform the reactivity because the positive reactivity being step in the Reactor Shutdown procedure for passively inserted from the down power/cool inserting the control banks until this off- down was slightly greater than the negative normal procedures had been exited (see reactivity being passively inserted by xenon; discussion in the "Safety and PI&R Concerns" through 09:36, 114 inward steps of rod section). movement and 220 gallons of boron were required to keep temperature lowering at the Xenon-135 induced Cooldown desired rate (the boron additions were done during the first 21/2/2 hours of the downpower, At 09:36 the unit was at 9% power and the when the rate of xenon buildup was still low; operators discontinued down powering the see Figure 1).
turbine-generator. It is not clear why this occurred, but since they were 21/2 hours When the crew ceased lowering turbine-ahead of schedule it is likely they intended to generator load at 09:36, positive reactivity hold power at -10% while further trouble was no longer being passively inserted from shooting occurred on the failed inverter. the downpower. However, since Xenon-135 was still building up, negative reactivity was Also around 09:36 the operators cycled the still being passively inserted. The crew did Group B turbine drains. One of the switches not have a detailed Reactivity Management for the drains was not indicating properly, Plan 10 and, because of their experiences requiring the operators to locally observe the during the past three hours," failed to operation of the thirteen valves controlled by recognize that, with the downpower no longer the malfunctioning switch. occurring, they needed to actively insert positive reactivity to keep average coolant By 09:36, the 10%/hour downpower which temperature stable.
had been occurring for the past 81/2 hours was causing a significant Xenon-1 35 Starting at 09:36, average reactor coolant transient. The constant build up of xenon temperature (T3,g) began to lower at about was inserting negative reactivity at a 220F/hr. With Xenon-135 continuing to insert significant rate; however, prior to 09:36 it was negative reactivity, the reactor would having little effect on reactor plant occasionally become slightly subcritical parameters. The build up of xenon went causing power to lower below steam demand.
largely unnoticed because, although With power less than steam demand, Tay
'(Those with access to proprietary documents from the World Association of Nuclear Operators should see the recommendations contained in WANO SOER 2007-1, Reactivity Management, for expectations regarding Reactivity Management Plans the 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> since relieving the watch at 06:30 the crew had needed to insert control rods 30 steps in order to keep Tavg S'TIn lowering at the programmed rate. No active insertions of positive reactivity had been required to overcome Xenon-135.
8
Table 11: Noteworthy Activities Performed during the Temperature Transient The "mark" column refers to the letter on Figure 4 which marks the activity/milestone in relation to the plant conditions which were present when the activity was being performed.
mark time Activity/Milestone For unstated reasons, the crew secured the generator load decrease at 9% rated reactor power.
Xenon-] 35 buildup caused reactor power to continue to passively lower for another three minutes and stabilize at 8% rated reactor power, resulting in an -1 % power mismatch.
The power mismatch caused T.yg to begin to lower and passively insert positive reactivity.
This positive reactivity was inserted at a rate which matched the negative reactivity being inserted by the buildup of Xenon-135 resulting in reactor power remaining stable at 8% rated power while temperature steadily fell at 22°F/hour.
D 09:36 Control banks C and D were inserted 6 steps since, prior to stabilizing the turbine load, the trend in reactivity management was to occasionally actively insert negative reactivity to counter act the passive positive reactivity insertion resultant from the turbine load decrease and the programmed decrease in average coolant temperature. This was the last active insertion of negative reactivity for the next 2Y2 hours.
It was at about this time that the operators placed the turbine drains in service per the Reactor Shutdown procedure. About a dozen minutes later the operators mistakenly believed that faulty turbine drains were the cause of the.temperature transient (see page 9 of Reference 9).
Operators began adding water to the Volume Control Tank (VCT) in order to dilute boron from the reactor coolant system to assist in mitigating the temperature decrease.
Also about this time the operators responded to the lowering reactor coolant temperature by E 09:47 performing an attachment in the shutdown procedure to minimize excessive cooling. One of the steps taken was to reclose the turbine drains. Indication was lost on the turbine drain valve hand switch (which controls 13 different drain valves) so the crew dispatched Equipment Operators to visually identify any valves which were not closing (see page 10 of Reference 9).
Letdown system automatically isolated on low Pressurizer water level; not all valves 09:59 functioned properly. The crew enters the off-normal procedure for "Loss of Letdown".
At about this time'average reactor coolant temperature fell below 55 1F, the Minimum F Temperature for Critical Operations (MTCO).
Operators secured the water addition to VCT. For the next 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, no active means are used 10:00 to control reactivity.
The operators recommenced lowering turbine-generator loading to take the turbine off-line Operators manually tripped the turbine-generator at an average coolant temperature of 550.4°F G 10:12:35 and 6% rated reactor power. The resultant rise in Tavg caused the reactor to go substantially subcritical. With no operator action, the reactor passively transited towards the Point of Adding.Heat (POAH).
lowered slightly. Due to the -MTC, the xenon with a lowering of Ta,,.
lowering T.,g inserted positive reactivity and caused the reactor to return to a critical state. The crew mistakenly believed that In this manner, the reactor passively malfunctioning turbine drains were causing remained critical (i.e. passively overcame the the drop in T8 ,g, so instead of aggressively negative reactivity being inserted by inserting positive reactivity (e.g. by diluting Xenon-135) by responding to the buildup of boron or withdrawing rods), they coordinated 9
with equipment operators in the turbine assist in recovering temperature, the Shift building to troubleshoot the turbine drains. 2 Manager directed that the turbine be taken The only positive reactivity actively inserted off-line.
the entire day was a 360 gallon add of water to the Volume Control Tank which occurred Manual Turbine Trip and MODE 2 Entry between 09:47 and 10:00.
After the letdown isolation, the operators Letdown Isolation began lowering turbine-generator loading in preparation for removing the turbine from By 10:00 T.9 g had lowered 97F and the service. This caused a positive power letdown system automatically isolated on low mismatch which temporarily caused Tvg to pressurizer water level. Also by 10:00, the stop lowering (the minimum T,, 9 occurring at crew recognized that Tavg had fallen below 10:03 in Figures 1 and 3 corresponds to the 551 0 F, the Minimum Temperature for Critical lowering of turbine load below reactor power).
Operations (MTCO) at Callaway Plant. To Between 10:03 and 10:09 the negative (i LA W~ r4 lzr ?' 0 rn W M~ N 0
7!4 7! "i " In In m T In 7 Cr4 0' 0~ N 4 4 -4 14 -4 -.4 1-4 1-4 1-4 H4 1-TT 560' F 560' ......... no load Tavg (557
~-555-F S55'F Tava(linear scale, 5'F/division);'
AT i--"2 1551*F)
I.. ....
550"F NFHR ------------ ;-------
11E-04 I.E-05 I.ý.. ýý_I. - - ý.. . . ......
... 1.E-06
- IRNI channels I (log scale, one decade/(divisiun) 7\ POAH
.2 1.E-07 z I.E-08 IRNI J),,.nnel 2 log s.:;c ono di-,cade/'ev* kin)
I.E-09 I.E-10 1 1E-1 1 - _ .. . .J _ .. .. 1 -_ ...... .. 1 .. l :. . - -.. ... 1 . . . . . ..: . ........ I , E -1I Figure 3: Plot of Average Coolant Temperature (Tav,), Primary Calorimetric power (AT) and Intermediate Nuclear Instrument currents (IRNI) on October 21, 2003. The sharp rise in T, was caused by the power mismatch resulting from manually tripping the turbine at 6% power and 550.47F with the steam dumps set at 1092 psig (5577F). The negative reactivity inserted by this temperature rise caused the reactor to passively shut down. The leveling out of the AT trace at 10:23 indicates the Point of Adding Heat. The leveling out of the IRNI traces at 10:39 indicates entry into the source range. See Figure 4 for plant evolutions occurring during this time frame.
"2 The NRC assessment of the transient was that the operators did not recognize that the reactor was responding to the steady state main turbine demand through the reactor coolant system temperature decrease, which then caused the decrease in pressurizer level and the letdown system isolation. See page 2 of the Enclosure to Reference 8 and page 10 of Reference 9.
10
reactivity being inserted by xenon was 10:18 SUR was -0.16 dpm - a change of addressed with power defect instead of 1600%.
temperature defect.
As the reactor neared the Non-Fission Heat At 10:12:35 the operators manually tripped Rate (1.75% rated reactor power for this the turbine-generator with reactor power just shutdown), temperature-reactivity feedback under 6% and Tav. at 550.40F. Prior to was lost (see Figure 2); that is, lowering tripping the turbine, the operators had, per reactor power would no longer feed back their procedure, set the condenser steam positive reactivity via lowering temperature.
dumps to open at 1092 psig (which Thus, without a manual insertion of positive corresponds to 557 0 F, the "no-load" average reactivity, power would continue to lower into coolant temperature at Callaway Plant). the source range.
However, because of the confusion resulting from the temperature transient and automatic At 10:13, the AT instruments had indicated letdown isolation, the crew missed the 5.17% and the Intermediate Range Nuclear procedure step to "Hold Reactor Power Instruments (IRNIs) had indicated 1.52E-5 ion constant by transferring load to the chamber amps (ica). By 10:18, AT condenser steam dumps while reducing instruments indicated 2.4% and the IRNIs Turbine Load. This will prevent inadvertent indicated 2.43E-6 ica. So in the time it took entry into Mode 2 when the Turbine is total power (as indicated by core AT) to lower tripped." to 1/2/2 its initial value, fission power (as indicated by IRNI currents) lowered to 1/6 its Within 30 seconds of tripping the main initial value. This is further indication the turbine, reactor power lowered below 5% and fission reaction had shut down and the Non-the operators declared MODE 2. Fission Heat Rate was raising/maintaining reactor coolant temperature.
Rapid Rise in T,,, and Passive Shutdown Response to the Passive Shutdown With the condenser steam dumps set to modulate at 1092 psig, upon tripping the While the reactor was passively shutting turbine there was no steam demand until Tvg down, the operators were performing the off-rose to 557°F (corresponding to a steam normal procedure for "Loss of Letdown" pressure of 1092 psig). With the reactor (which had been entered at 10:00). At 10:18, initially around 6% power and with no steam a 75 gpm letdown orifice was placed in demand, Tavg rose rapidly: 1IF within the first service and the crew exited the off-normal 20 seconds, 2.5 0 F in the first minute, 4°F in procedure. By this point (10:18), had they the first two minutes, and the full 6.6°F rise recognized the reactor was shut down, it was (corresponding to 557°F) within five minutes. already too late to prudently try to recover The sharp insertion of negative reactivity criticality.
resultant from this temperature rise caused the reactor to passively shut down, as After exiting the off-normal procedure for indicated by the Start Up Rate (SUR) data. "Loss of Letdown" the Control Room When the turbine was tripped at 10:12:35, Supervisor assigned the Reactor Operator SUR was -0.01 decades per minute (dpm); by the task of raising letdown flow to 120 gpm by 11
Table III: Noteworthy Activities Performed as the Reactor Passively Lowered to Source Range The "mark" column refers to the letter on Figure 4 which marks the activity/milestone in relation to the plant conditions which were present and the other activities performed.
mark time ActivityfMilestone The operators placed a 75 gpm letdown orifice in service and exited the off-normal procedure for "Loss of Letdown". The operators were still in the off-normal procedure for "Loss of Safety Related Instrument Bus" due to the Auxiliary Feedwater surveillance having not yet been completed by an Equipment Operator. The NRC did not find that the implementation of either 10:18 off-normal procedure prevented the control room operators from inserting the control rods at H any time during the shutdown (see page 4 of the Enclosure of Reference 8). Instead of inserting the control banks, the Control Room Supervisor assigned the Reactor Operator the task of placing the 45 gpm letdown orifice in service per the normal operating procedure in order to optimize plant chemistry by raising letdown flow from 75 gpm to 120 gpm.
10:19 For unstated reasons, the operators raise the lift setpoint of the condenser steam dumps, causing Tavg to begin to rise from 557°F to 5601F and further lower K f.
Approximate time fission power lowered below the Point of Adding Heat (POAH) as indicated by total power (e.g. the AT instruments) leveling out as fission power (e.g. the IRNI currents) continued to lower exponentially. A nominal -1/3 dpm SUR developed at this point due to the absence of temperature-reactivity feedback (i.e. non-fission heat sources were able to maintain S 10:23 temperature as fission power lowered, so a lowering of fission rate did not cause a corresponding lowering of temperature and a subsequent insertion of positive reactivity). As reactor power passively lowered towards the source range, the licensed operators were assigned normal procedure tasks for placing cooling tower blowdown in service (which had been secured at 08:17) and securing an intake pump (two intake pumps were originally running but, with the reduced evaporation rate due to the downpower, one pump could now be secured).
3 10:34 Licensed operators complete assignments for placing cooling tower blowdown in service and lowering intake flow.
placing the 45 gpm orifice in service per the pumps (cooling Tower Blowdown had been normal operating procedure. It is unclear why secured a couple of hours earlier to support this task was prioritized over actively Chemistry surveillances and the intake pump controlling core reactivity (i.e. over inserting was secured because two pumps were no the control banks to ensure the reactor longer needed due to the forced de-rate remained shutdown). This task involves causing evaporation rate to lower). These multiple manipulations of charging system tasks were both logged complete at 10:34. It components and took 30 minutes to is unclear why these tasks were prioritized complete; in comparison, manually driving in over inserting the control banks..
the control banks takes 10 minutes.
Operation in the Source Range As reactor power was decaying through five decades of power to reach the source range, At 10:39, reactor power entered the source licensed Reactor Operators were assigned to range, as evident on Figure 4 by the lRNI place Cooling Tower Blowdown in service currents stabilizing. As at most reactor and to secure the second of three intake plants, the Source Range Nuclear 12
Control Room Activities, Rod Heights, Average Coolant Temperature, Total Power and IRNI Currents during October 21, 2003 Passive Reactor Shutdown at Callaway Plant 8:00 9:00 10:00 11:00 12:00 Figure 4: Plot of Control Bank rod heights, Average Coolant Temperature (Loop I Tavg instrument), total power (Loop I AT instrument) and Intermediate Range Nuclear Instrument (IRNI channels I and 2) currents on October 21, 2003. The reactor passively shut down shortly after the turbine was manually tripped at 10:13 and reached the source range about 26 minutes later. A nominal -1/3 dpm SUR developed as power fell below the POAH. The slight drop in reactor power from 10:39 to 12:05 was caused by a lowering of subcritical multiplication resulting from the continued buildup of Xenon-135. The operators began inserting the control banks at 12:05 and completed at 12:15. The control banks consisted of four banks (A, B, C, D) whose insertion is staggered. The 'D' bank rods were the first to insert and the 'A' bank rods were the last. The letters on this plot annotate various activities which are found in Tables I through IV. Items 'B' and '0' indicate, respectively, the times when the crew entered and exited the off-normal procedure for "Loss of Safety Related Instrument Bus". Items 'F' and 'H' indicate, respectively, the times when the crew entered and exited the off-normal procedure for "Loss of Letdown",
The NRC did not find that the implementation of either off-normal procedure prevented the control room operators from inserting the control rods at any time during the shutdown (see page 4 of the Enclosure to Reference 8).
Instruments (SRNIs) at Callaway remain de- calibrated. As a result, the SRNIs did not energized until bistables on the IRNIs validate energize upon initially entering the source reactor power is in the source range. range. It took 45 minutes of additional Because the control rods were still at their Xenon-135 buildup to lower subcritical last critical rod heights, there was more multiplication to the point at which the first subcritical multiplication than is normally SRNI channel was able to automatically present when these IRNI bistables are energize.
13
At 11:01 a licensed operator was assigned to manipulation of the condensate system over secure the second of three condensate inserting the control banks.
pumps. It is unclear why, while in the source range with no SRNIs energized and with the To some (e.g. this author) the crew's actions control rods still at their last critical rod indicate that they were unaware the reactor heights, the licensed operators prioritized had passively shut down. That is, the most Table IV: Noteworthy Activities Performed with the Reactor in the Source Range The "mark" column refers to the letter on Figure 4 which marks the activity/milestone in relation to the plant conditions which were present and the other activities performed.
mark time Activity/Milestone IRNI traces leveled off indicating that most Delayed Neutron Precursors (DNPs) had decayed and neutron population was now being determined by source neutrons and subcritical multiplication. An unperceivably slight negative startup rate remained (-0.07 dpm) as the continual buildup of Xenon-135 lowered subcritical multiplication. Due to the control rods still K 10:39 being at their last critical rod heights, subcritical multiplication was too great to allow the IRNI currents to fall below the reset point required to energize the Source Range Nuclear Instruments (SRNIs). As a result, the reactor was in the source range without: an audible neutron count, automatic protections afforded by the Boron Dilution Mitigation System (BDMS), the SRNI high flux trip (which comes in 5 decades below the IRNI high flux trip), and SRNI indication.
The reactor operator completed placing a 45 gpm letdown orifice in service per the normal L 10:48 operating procedure. There is no indication in the logs of any activities preventing the insertion of the control banks.
The second of three condensate pumps was secured. The basis for this step is to minimize "house" electric loads. While performing this activity, the crew was operating in the source M 11:01 range with: (1) no SRNIs energized, (2) the control rods still at their last Critical Rod Heights and (3) no formal calculation present to verify Xenon-135 levels were sufficient to prevent an inadvertent reactor restart during postulated dilution or cooldown events.
The Channel 2 Source Range Nuclear Instrument energized with an initial reading of 3044 cps.
This should have caused the SR HI VOLT FAIL alarm on the main control board to annunciate.
11:34 The auxiliary feedwater surveillance required to exit the off-normal procedure for "Loss of 0 Safety Related Instrument Bus" was completed and delivered to the Control Room Supervisor.
11:37 The crew exited the off-normal procedure for "Loss of Safety Related Instrument Bus".
The Channel I SRNI energized with an initial reading of 2593 cps. This should have caused the SR HI VOLT FAIL alarm on the main control board to annunciate as the alarm cleared.
The motor driven Start Up Feed Pump was started in preparation for securing the final turbine driven main feed pump.
The reactor operators commenced a Containment Minipurge.
P The Shift Technical Advisor commenced a Shutdown Margin Calculation. This calculation was not completed and reviewed until 12:55. From 10:13 (when the Shift Manager recognized the 11:42 reactor would go subcritical - see page I I of Reference 9) to 12:05 (the time control rod insertion commenced) the crew was informally relying on thumbrules and Xenon-135 estimates from a Xenon Prediction to ensure that sufficient shutdown margin was present to prevent an inadvertent reactor restart in the event that an unplanned dilution or cooldown were to occur.
Q 11:51 The operators secured the last turbine driven main feed pump.
R 12:05 The operators began inserting the control banks.
14
reasonable explanation for the crew hours after the 40 F temperature spike which "prioritizing" ancillary tasks1 3 over deliberate caused the passive reactor shutdown.
control of the nuclear fission reaction, is that for 67 minutes they failed to recognize the HUMAN PERFORMANCE ASPECTS 14 reactor had shut down.
Xenon-135 Cooldown At 11:25 the channel 2 SRNI energized.
Since a Main Control Board alarm The temperature transient which significantly annunciates whenever a SRNI channel contributed to the confusion that resulted in energizes, it can be confidently assumed that the passive reactor shutdown was a result of at 11:25 the crew was aware they were in the the operators failing to account for source range. At 11:38 the channel 1 SRNI Xenon-135 when they stopped the turbine energized. downpower at 09:36. Although operators might well understand the physics of At 11:40 a licensed operator placed the motor Xenon-135, applying this knowledge while driven Start Up Feed pump (S/U FP) in conducting a busy forced de-rate and while service in preparation for securing the second being distracted by equipment malfunctions is of two turbine driven Main Feed pumps much more difficult than applying this (MFPs). At 11:42 a Reactor Operator knowledge while taking a Generic initiated a Containment Mini-Purge. At 11:51 Fundamentals Exam. Two possible solutions the final MFP was secured. It is unclear why to aid the operators in adequately assessing these tasks were prioritized over inserting the xenon are to have readily available Operating control banks. Experience (OpE) listed on procedure-specific pre-job brief forms and to require From 12:05 to 12:15 the Reactor Operator Reactor Engineering to prepare detailed inserted the control banks. Control bank Reactivity Management Plans for forced de-insertion was not completed until over two rates.
13For example: placing an extra 45 gpm letdown orifice in service, placing Cooling Tower Blowdown in service, securing unnecessary intake and condensate pumps. Although optimizing water chemistry of the primary plant and cooling tower is important and although minimizing "house" electric loads by securing large and no longer needed pumps is important, these tasks are "ancillary" with regard to the primary focus of the reactor shutdown procedure: inserting the control banks to definitively ensure the reactor is in a shutdown condition and will remain in that state regardless of passive (e.g. xenon decay) or unexpected (e.g. inadvertent dilutions or cooldowns) changes in core reactivity.
14lt should be noted here that the crew has consistently asserted (e.g. in the Lead Response to Actions 5 & 6 of Callaway Action Request 200702606 and during interviews with the NRC Office of Investigations on March 31/April 1, 2008) that prior to manually tripping the turbine they were aware the reactor would passively shut down once steam demand was removed. This assertion amounts to the crew deliberately allowing the reactor to passively shut down while they performed the ancillary items mentioned in note 13. The author of this article believes that, if true, this amounts to incompetence. That is, it is incompetent for an NRC licensed operator to prioritize ancillary tasks over deliberately controlling the reactor, and it is incompetent to deliberately rely on passive measures to shut down the reactor when active means (e.g. rods and boron) are available. Since the US NRC has refused to question the operators' assertions (see .N.-l/IO.4LL2t(L9S?,), at this point the question remains unresolved as to whether or not, prior to the SRNIs energizing, the operators were aware the reactor had passively shut down. Although the Institute of Nuclear Power Operations (INPO) is aware of the discrepancies surrounding the October 21, 2003 shutdown, INPO has similarly declined to evaluate the claims made by the operators; since INPO must rely on Ameren to voluntarily report the incident, INPO has stated that it is in no position to conduct its own assessment. For those interested, the claims of the operators are summarized in enclosure 2 to NRC ADAMS document %-11-I 11401104 and are analyzed in detail in \11.. *I i26400'4.
15
Challenges of MODE 2-Descending power in MODE 2. Due to cold-leg shielding and decay gammas, Power Range Due to the degradation of Temperature- Nuclear Instruments (PRNIs) do not Reactivity feedback which occurs in accurately reflect fission power and will MODE2-Descending (see Figure 2), if there continue to read -1% rated reactor power is a need to remain critical at low powers even after the reactor has entered the then the reactor should remain in low source range.
MODE I (i.e. greater than 5% power).
The only accurate indications of fission Because of the Temperature-Reactivity power in MODE 2-Descending are the feedback afforded in MODE 1, operators IRNIs; however, these instruments are can rely on temperature to passively human factored for conducting reactor respond to reactivity changes. Near the startups and not for maintaining MODE 2.
Non-Fission Heat Rate (i.e. in MODE 2) the Because of the significant range of these operator must directly respond to reactivity instruments (i.e. 10 decades of power) they changes (e.g. xenon buildup) with active have substantial calibration errors. These reactivity manipulations (e.g. rods or errors have little effect on the operator as boron/water). Whereas it is not very difficult long as the operator is using these to maintain temperature through the active instruments to detect CHANGES in fission insertion of reactivity, it can be extremely power and not as an absolute measure of difficult to actively respond to reactivity fission power. For this reason, these changes directly (while at the same time instruments are intentionally scaled in ion ensuring the reactor neither exceeds 5% chamber amps instead of percent rated power nor drops below the POAH). power. That is, the calibration errors prevent these instruments from accurately Recognizing the Passive Shutdown indicating absolute power levels so they were intentionally "human factored" to use Although the operators claim otherwise, it units which are not easily converted into appears that for 67 minutes (from 10:18 to percent rated power or into MWth, thus 11:25) they failed to realize the reactor was discouraging the operator from using them shutdown. Whether or not the operators while attempting to maintain discrete power were aware of the passive shutdown as it bands. Attempting to use the IRNIs to was occurring, it is still worth exploring maintain a power band from the POAH to some of the "human factors" pitfalls 5% is unwise. Furthermore, although associated with attempting to maintain recognizing when the Point of Adding Heat MODE 2-Descending. has been attained during a power ascension is straight forward, during a downpower it is There are no adequate instruments for impossible to recognize the POAH until indicating fission power when attempting to fission power is substantially below it.
maintain MODE 2-Descending. Due to decay heat and other non-fission heat See References 2 and 6 for further sources, both primary calorimetric (e.g. AT discussion of technical lessons learned.
instruments) and secondary calorimetric Also, see Figures 2 and 6 for comparison of instrumentation are poor indicators of fission the AT and IRNI signals as fission power 16
lowered below the Point of Adding Heat "holding" power during a xenon transient during the October21, 2003 and June 17, were different than the actions needed for 2005 passive reactor shutdowns at "reducing" power. The procedure did not Callaway Plant. take into account the limitations of the operator's control equipment (i.e. the SAFETY AND PI&R CONCERNS degradation of Temperature-Reactivity feedback) and monitoring equipment (i.e.
No PI&R effort in 2003 affect the NFHR and decay gammas have on total power meters) in MODE 2-For unknown reasons the passive reactor Descending. Management expectations shutdown was not documented in the were unrealistic; it was unrealistic to expect plant's corrective action program in 2003. the crew, with procedural guidance written The failure of the crew to document the for a continuous (i.e. "non-segmented")
passive reactor shutdown resulted in the shutdown, to be able to hold the reactor at organization failing to perform adequate 10% rated power during the severe xenon Problem Identification & Resolution (PI&R). transient induced from an aggressive 9 hour1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> That is, without a condition report downpower at 10%/hour. However, since documenting either the xenon induced the October 21, 2003 passive reactor letdown isolation or the inadvertent passive shutdown was not documented until it was reactor shutdown, the organization was accidentally uncovered 40 months after the unaware that it had an event which it could fact, these gross procedural deficiencies analyze for "problems" needing "resolution". and unrealistic management expectations The purpose of writing a condition report is went uncorrected until 2007.
not to "turn yourself in for making errors"; it is to provide the organization a record of the On June 17, 2005 a similar passive reactor known (or perceived) facts so that these shutdown occurred during a forced de-rate facts can be analyzed for potential for a failed power supply in an Engineered "problems" (e.g. inadequate procedural Safeguards Feature (ESF) cabinet (see guidance, operator knowledge weaknesses, Figures 5, 6 and 7). During this de-rate, the unrealistic management expectations) and reactor passively shut down due to a 20 F these problems can then be analyzed for spike in T,,g which occurred upon manually
.resolutions" (e.g. improved guidance). tripping the main turbine. The shutdown occurred two minutes prior to the failed There are some (e.g. this author) who power supply being successfully retested believe that on October 21, 2003 the crew and 54 minutes prior to the expiration of the was "set up for failure". The general shutdown action of the Technical operating procedure for conducting the Specification. That is, since the broken down power and reactor shutdown was equipment was successfully repaired prior poorly structured. The procedure assumed to the planned shutdown time, had the that in order to stop the down power the reactor not passively shut down the crew operators needed to do nothing more than could have immediately returned to power.
delay continuing in the procedure. The Instead, resultant delays in returning to procedure made no recognition that the power following the inadvertent passive actions the operators needed to take for shutdown cost the utility 31 hours3.587963e-4 days <br />0.00861 hours <br />5.125661e-5 weeks <br />1.17955e-5 months <br /> of lost 17
Plot of Total Power (AT), Average Coolant Temperature (Tavg), Control Bank
'D' Rod Heights, and Intermediate Range Nuclear Instrument currents (IRNI) during the June 17, 2005 Passive Reactor
.....-.. 7... 7--t Shutdown at Callaway Plant
- - - -- . I 560'.
II 555...-- -- .. . - .. -555"F
' U
.E-O10a 1--
.I .... . . .. . . .. .. .. .. . . . . .. . . i 20 -M' 11-08 L- 0 0.
- 0Ch RN Temperature-e2 oanntl I0 ------
ru11-069t 1.EJ09u J 1, 0 23.E-0 23IE32-3302;02:00:O 01 ;0 0:0 04 :0 1 0O June 16, 2005 June 17, 2005 Figure 5: At 19:02 on June 16, 2005 Callaway Plant entered a 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> Technical Specification shutdown statement due to a failed power supply to an Engineering Safeguards Feature (ESF) cabinet. By 23:00 the reactor was around 33% power and shutting down at nominally 30%/hour. At 00:07:25 on June 17, 2005 the reactor operators manually tripped the main turbine. Immediately following the turbine trip, T., 8 rose 2.5°F in a 35 second time period. Just like on October 21, 2003, the sharp spike in T.,, caused the reactor to inadvertently passively shut down. By 00:10 fission rate had already dropped to half its pre-turbine trip value when the operators were notified that the ESF cabinet had been restored to operable and the shutdown was no longer required. Unaware of the passive shutdown, the Reactor Operator withdrew control rods six steps at 00:19:30 and again at 00:20:50. Noticing that the reactor failed to respond as expected, at 00:25 the RO informed the CRS that the reactor had passively shut down. The crew began manually driving in the control rods at 00:39. The incident was not documented until February 2007.
18
generation. Like the 2003 passive shutdown, The two shutdowns were documented along the 2005 passive shutdown was not with seven other shutdowns in Callaway documented until it too was accidently Action Request 200701278, Analysis of Past uncovered in February 2007. Had the Reactor Shutdowns - RF15 Preparation October 21, 2003 passive reactor shutdown Concerns. In their August 10, 2007 cover been evaluated by the utility's Problem letter distributing WANO SOER 07-01, Identification & Resolution process, it is likely Reactivity Management, INPO requested that the 2005 passive reactor shutdown would their member utilities "provide information on never have occurred. similar occurrences and solutions at their plants". For unexplained reasons, Ameren Although the inadvertent passive shutdown of determined that neither the October 2003 nor a commercial PWR might seem like a the June 2005 passive reactor shutdowns commercial concern vice a safety concern, was worthy of sharing with the industry.
failing to recognize it can readily jeopardize Since no INPO SEN concerning the October reactor safety. In February 2005, the 2003 passive shutdown has been released operators of a reactor in Virginia were since the NRC's issuance of IN 2011-02, it attempting to maintain the reactor in MODE appears that INPO agrees with Ameren's 2-Descending while repairs were being decision that a passive reactor shutdown conducted on the secondary plant. The resulting in a two hour delay in inserting reactor passively shut down and the control banks does not meet the threshold for operators failed to notice it, Two hours later, a Significant Event Notification. In the the reactor inadvertently restarted following a absence of a detailed INPO document on the manual positive reactivity addition which was incident, interested nuclear professionals conducted by operators who had failed to should review the issue brief released by the recognize the reactor had entered the source Union of Concerned Scientists (see range. Like the October 2003 passive reactor Reference 2).
shutdown at Callaway Plant, the operators failed to document the event. Unlike the Informally Relying on Xenon-135 Callaway incident, when the incident in Virginia was brought to the attention of plant One of the more troubling aspects of the management, an investigation was performed operators' claim that they were consciously and the results were reported to the Institute aware the reactor had passively shut down is of Nuclear Power Operations (INPO) and that this claim amounts to informally relying shared with the industry via a Significant on Xenon-135 to prevent the reactor from Event Notification (SEN). inadvertently restarting.
Sharing OpE with INPO Several times during the downpower, the operators performed a "Xenon Prediction". A Both the October 21, 2003 and June 17, Xenon Prediction estimates Xenon-1 35 levels 2005 passive reactor shutdowns were based on proiected power history, and it is accidently uncovered in February 2007 during used as a tool to assist the operators in a review of critical parameter data from past maintaining the reactor critical. A Xenon shutdowns to support a major revision to the Prediction is very different from a Shutdown Reactor Shutdown Procedure. Margin Calculation. Although there are times 19
Logarithmic Plots of Total Power (AT) and Fission Power (IRNI) during the June 17, 2005 Passive Reactor Shutdown at Callaway Plant 2.9E-05 2.9E-06
.. . 29E-07 0 0.1 ....
L.
I. I 2.9E-08 001. I.
2,9E-09 0.001 0:30 0:32 0:06 0:08 0:10 0:12 0:14 0:16 0:18 0:20 0:22 0:24 0:26 0:28 readings) and fission power (as Figure 6: Logarithmic plots of Total Power (as represented by AT instrument June 17, 2005 passive reactor shutdown represented by Intermediate Range Nuclear Instrument currents) during the manual turbine trip which caused a sharp at Callaway Plant. The vertical line at 0:07:25 indicates the time of the 85 inserted by this temperature increase rise in Tavg with reactor power at . % rated power. The negative reactivity exponentially (as indicated by the IRNI caused the reactor to go substantially subcritical. As fission power lowered exponentially, total power began to currents) the decrease in total power was not proportional. Instead of lowering dashed green line on the graph). The asymptotically approach the Non-Fission Heat Rate (as indicated by the on Temperature-Reactivity feedback causing it mismatch between fission power and total power has a strong impact to completely disappear at the Point of Adding to degrade as MODE 2-Descending is approached and causing it affect reactivity as the NFHR is approached, Heat (POAH). Although temperature continues to directly a negative reactivity insertion does not Temperature-Reactivity feedback is lost because falling fission power from lowering.
"buffer" temperature from dramatically immediately affect temperature since non-fission heat sources time the POAH was reached is The POAH is denoted by the dashed pink line on the graph and the approximate as to exactly when total power reaches the noted by the dashed vertical line at 0:27. Since there is some subjectivity The arrows at 0:19:30 and 0:20:50 indicate 6 step control Non-Fission heat rate, the POAH is just a rough estimate.
recognizing the passive shutdown.
rod withdrawals which were done by the reactor operator prior to when a Shutdown Margin Calculation will rely postulated positive reactivity additions (e.g.
on Xenon-135 for Shutdown Margin (SDM), inadvertent dilutions, inadvertent cool downs, when this is done it is based on actual power etc.) whereas a Xenon Prediction assumes history. Another major difference between no failures and is used to estimate the the two calculations is their uses: a SDM amount of negative reactivity which must be calculation is used to ensure the reactor will overcome to maintain the reactor critical.
not inadvertently return to criticality during Since a SDM calculation was not completed 20
on October 21, 2003 until forty minutes after It is unclear why the NRC inspector expected the control banks had been inserted, the the Reactor Shutdown procedure to contain crew, for the 106 minutes they claim they "timeliness guidance on performing the steps knew the reactor was shutdown (10:18 to to insert the control rods." Like the normal 12:05) yet were still retaining the rods at their (i.e. non-faulted) reactor shutdown last critical rod heights, inexplicably relied on procedures at all US commercial reactors, an informal estimate that Xenon-135 levels Callaway Plant's Reactor Shutdown were large enough to prevent an inadvertent procedure contained no provisions for restart. Following the Shift Technical intentionally allowing the reactor to passively Advisor's calculation of Shutdown Margin (at shut down. Per the procedure, the only way 12:49), the crew added over 3600 gallons of to shut down the reactor was to manually boron in order to meet the required SDM. insert the control banks. Since the procedure inherently assumes it is followed and since Since Xenon-135 is a radioactive isotope with the procedure requires the control banks be a half-life of 9.2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, a reactor requiring manually inserted to effect the shutdown, Xenon-135 to maintain it subcritical will then it would be nonsensical for the eventually return to power. Although the procedure to contain "timeliness guidance on physics of Iodine-135 and Xenon-135 are performing the steps to insert the control well understood, informally relying on rods". That is, since the reactor is shut down estimations when formal calculations are by manually inserting the control banks, it available is contrary to the principles of would not make sense for the procedure to conservative reactor operation. If there is a dictate a time frame for inserting the control commercial reason to rely on Xenon-135 to banks FOLLOWING a passive reactor maintain Shutdown Margin, a formal SDM shutdown.
calculation should be performed and reviewed PRIOR to relying on Xenon-135 to Nonetheless, the NRC has thus far maintain the reactor shut down. maintained its 2007 position that no violations occurred other than the two NCVs concerning Operating beyond Procedure Guidance the lack of a log entry and condition report. In Information Notice 2011-02 the NRC In 2007 the US NRC investigated the October specifically avoided addressing whether or 21, 2003 passive reactor shutdown. not they believed the operators were aware of Although they issued non-cited violations the passive reactor shutdown prior to the first (NCVs) for the operators failing to make a log SRNI channel energizing. [Note: The author entry documenting operation below the of this article was a reviewer for IN 2011-02 MTCO and for the operators failing to and is the owner of the initial block which has document the passive shutdown with a a "Non-Concur" in it on the routing page. The condition report, the NRC found no problems Non-Concurrence Form and NRC response regarding the two hour delay in the insertion can be found in ADAMS under of the control rods. Concerning this delay, ML110420293.]
the NRC stated "The inspector's review of the operating procedures did not find any Note that it is the opinion of this author it is timeliness guidance on performing the steps not a procedure violation to unknowingly to insert the control rods." allow the reactor to passively shut down.
21
Plot of Total Power (AT), Average Coolant Temperature (Ta,,), and Intermediate Range Nuclear Instrument currents (IRNI) for both the October21, 2003 and
....... ........ the
!........ .June
..... 17,
............. -......2005
. - .......Passive
. .. ...Reactor Shutdowns
-[......................................
i 5607F ............
560*F 5550 F-T`- 555'F 550'F 11E-05 1E-05 1-E-06 1E-06 1.E-07 * ,o -- 1E-07 E "N
'N IFE-OS IE-08 E
.2 1.E-09 - 1E-09 i.E-iD E10.l i.E-li IE-1i
-3 0 3 6 9 12 15 18 21 24 27 30 minutes after manual turbine trip Figure 7: Comparison of the critical parameter data from the October 21, 2003 and June 17, 2005 passive reactor shutdowns at Callaway Plant. The "dashed" data is the June 2005 data. Notice that for both shutdowns the reactor was in MODE I when the turbine was tripped and for both shutdowns the reactor went substantially subcritical due to a sharp spike in average coolant temperature caused by a momentary loss of steam demand as steam header pressure rose to the lift point of the condenser steam dumps. The Point of Adding Heat and a nominal -1/3 dpm start up rate were reached quicker for the October 2003 transient because the reactor was closer to the POAH when the turbine was tripped (in 2003 fission power was just over twice non-fission power whereas in 2005 fission power was nearly four times non fission power) and because the negative reactivity insertion was larger due to a larger temperature spike. Similar to a reactor trip, on October 21, 2003 reactor power entered the source range about 25 minutes after the turbine trip. Neither passive reactor shutdown was documented in the plant's corrective action program until it was accidently uncovered in February 2007.
22
Operating a large commercial PWR at low unanticipated steam demand (e.g. a line power during an aggressive xenon transient break) is to eventually return to criticality and is not an easy task; combined with the to match steam demand. As soon as it is challenges already mentioned above (e.g. noted that the reactor has passively shut loss of Temperature-Reactivity feedback, down and as long as active means to control physical limitations of calorimetric indications the nuclear fission reaction are available, they of "fission" power near the NFHR, poor should be used to ensure the reactor is taken procedural guidance, lack of a detailed to, and remains in, a shutdown condition.
Reactivity Management Plan, equipment malfunctions) it should not be surprising to Loss of Safety Related Instrument Power any NRC licensed operator that the crew failed to perform flawlessly. Although most During the investigation of the October 21, operators would like to think that it would 2003 passive reactor shutdown, the Shift never take them 67 minutes to recognize the Manager indicated that the biggest delay in reactor had shut down, most do recognize inserting the control banks was the fact that that, given the wrong set of circumstances, the crew was still performing the off-normal any operator is capable of making a mistake procedure for the "Loss of Safety-Related such as this. It is not a procedure violation to Instrument Power" which had been entered at fail to recognize a passive reactor shutdown; 08:21 but was not exited until 11:37. Since it is a human performance error and no more. all the control room actions were completed And it is not a procedure violation to, due to a by 08:33 (an hour before the temperature human performance error, find oneself in transient which led to the passive reactor circumstances not expected by the shutdown), it is unclear exactly how this off procedure. When this occurs, the proper normal procedure delayed the insertion of the response is to use one's training and control banks during the hour following the experience to place the plant in an analyzed turbine trip. Nonetheless, for unstated condition (e.g. if the plant has passively shut reasons the NRC has decided to take the down, then manually insert the control operators at their word and not question how banks). Note that failing to recognize a the performance of this procedure inhibited passive shutdown as it is occurring is very the insertion of the control banks yet did not different from recognizing the reactor inhibit the operators from: placing the 45 passively shutting down and then gpm letdown orifice in service, placing intentionally prioritizing other actions above Cooling Tower Blowdown in service, lowering the deliberate control of reactivity. intake flow, or manipulating the feed and condensate systems. Those interested in this Whether or not the NRC chooses to address topic should consult References 4, 5 and/or 6 it, intentionally allowing a large commercial below.
reactor plant to passively shut down constitutes a fundamental misunderstanding Operation without SRNIs of the principles of conservative reactor plant operations. As discussed above, US The reactor entered the source range at commercial PWRs "want" to be critical and 10:39; yet, no Source Range Nuclear "want" to match steam demand. The inherent Instrument (SRNI) energized for another 45 passive response of the reactor to an minutes (11:25).
23
Each SRNI at Callaway Plant is powered
- a meter indication better suited for through a contact on its channel's associated monitoring power in the source range IRNI. This contact automatically closes at than the more broadly ranged IRNI 5E-1 I ica. Because of the subcritical meters.
multiplication afforded by the control banks " an automatic high flux reactor trip still being at their last critical rod heights, both which is set about 5 decades earlier channels of IRNIs were reading greater than than the IRNI high flux trip.
5E-1 1 ica when the reactor first entered the " a signal to the Boron Dilution and source range. It took 45 minutes of additional Mitigation System (BDMS) which Xenon-135 buildup for the channel 2 IRNI to causes an automatic swap over of lower below 5E-11 ica and 59 minutes for charging pump suctions from the channel 1. Volume Control Tank to the Refueling Water Storage Tank The SRNIs can also be manually energized (RWST) in the event that source once the PRNI signal has lowered below 10% range counts increase by 70% in a rated reactor power. Had they recognized rolling 10 minute period (since the they were in the source range prior to 11:25, RWST is borated to -2500 ppm, this the operators could have manually energized BOMS circuit provides protection either or both SRNIs. The fact that they did against unanticipated reactivity not do this is one of many indications to this additions such as uncontrolled author that, prior to the SRNIs automatically cooldowns and inadvertent dilutions).
energizing at 11:25, the operators were unaware they were in the source range.15 Although the Technical Specifications for Callaway Plant permit operation in the source At Callaway Plant the SRNIs add significant range with the SRNIs de-energized, this is so defense in depth during operation in the a reactor start up can be performed.1 6 During source range by providing: a reactor startup, administrative controls 1 7 are in place which mitigate the loss of safety Start Up Rate indication margin from blocking the automatic safety S an audible count rate which quickly circuits driven by the SRNIs. The designers alerts the operator to rising reactivity of Callaway Plant never intended for the plant 15Note that from 10:23 to 11:25 all indications other than the IRNIs were steadily indicating the plant was low in the power range: the PRNIs were reading -1% rated power, the AT instruments were reading 1.75% power and the secondary calorimetric computer points were reading 62 MWth. In order to realize they were in the source range the operators would have either had to note the IRNI readings or question why they had not needed to add positive reactivity to account for xenon buildup. With regard to noting the IRNI readings, because of their units (ion chamber amps) and their scaling (logarithmic) the operators do not normally use these instruments while at power. With regard to questioning why they had not needed to dilute or pull rods to make up for xenon, understanding the reactor dynamics of Iodine/Xenon was a weakness of this crew as demonstrated by their response to the 9°F temperature drop which occurred from 09:36 to 10:00.
161t is impossible to do a successful reactor startup without blocking the SRNI flux trip and BDMS; therefore, once the IRNI signal reaches 1E-10 lea dudng a reactor startup, the operators are permitted to de-energized the SRNIs (which by then have had all their protective functions blocked).
"7 For example: a Reactor Engineer present in the control room, an Estimated Critical Position has been calculated, the crew is intently performing a procedure which warns them to "expect criticality at any time", etc.
24
to be operated in the source range with the position of the US Nuclear Regulatory control rods at their critical rod heights and Commission or the Professional Reactor with none of the SRNI driven automatic Operator Society.
protections in place. Although the NRC is technically correct in stating that this To participate in an online analysis of this condition did not violate the plant's licensing incident and the NRC/utility's response, send requirements, there is more to ensuring an email to: RCSOTP 16 ReactivityControl-reactor safety than enforcing a verbatim subscribe~u~yahoogroups. corn (anonymous interpretation of the Technical Specifications; participation is accommodated).
not all conditions can be exactly defined by the Technical Specifications and a competent Anyone wishing additional information on this professional reactor operator should be able incident is encouraged to contact me at:
to discern when the plant is in a condition in which the designer never intended it to be.
SIGNIFICANCE REFERENCES Nuclear power lives and dies by its operators. 1. US Nuclear Regulatory Commission, Information Notice 2011-02, Operator Performance Issues It is the utility, not the regulator, who prevents Involving Reactivity Management at Nuclear Power accidents. The utility trains and employs the Plants,January 31, 2011.
licensed operators. The utility workers and 2. Union of Concerned Scientists, Issue Brief engineers have the expertise. The utility's 20101100, 2003 Segmented Shutdown at managers decide how to address Callaway, November 2010.
- 3. Non-Concurrence on NRC Information Notice vulnerabilities. The NRC might claim to 2011-02, Operator Performance Issues Involving protect people and the environment, but in Reactivity Management At Nuclear Power Plants actuality it is only the utility workers who can (ADAMS #ML110420293).
do so. The regulator's role is to ensure that 4. September 17, 2010 letter from L. Criscione to William Borchardt (ADAMS #ML102640674).
all nuclear utilities are making honest efforts
- 5. April 27, 2010 letter from Lawrence Criscione to to meet the minimum requirements for safe William Borchardt (ADAMS #ML101200401).
operation of their reactor plants, The NRC 6. April 30, 2010 letter from Lawrence Criscione to failing to adequately perform this role does William Borchardt (ADAMS #ML101230100).
not give the utility liberty to shirk its public 7. G2010059/EDATS: OEDO-2010-0775 - Petition Closure Letter to Lawrence S. Criscione Related to duties. The utility has a duty to address all Requested Action Under 10CFR 2.206 Regarding incidents of dishonesty and/or incompetency October 21, 2003 Event at Callaway Plant, Unit 1 regardless of whether or not the NRC or (TAC No. ME4721), ADAMS #ML110140104, INPO chooses to ignore them. January 19, 2011.
- 8. February 26, 2010 letter from Anton Vegel to Lawrence Criscione,
SUBJECT:
Response to DISCLAIMER Concerns You Raised to the US Nuclear Regulatory Commission (NRC) Regarding the The views expressed in this article are those Callaway Plant (NRC FOIA/PA-2010-00227).
of the author and in no way reflect the 9. Exhibit 22 of NRC Office of Investigations Case No.
4-2007-049 (NRC FOIA/PA 2009-0064).
Too often officials are willing to accept and adapt to situationsthey know to be wrong. The tendency is to downplay problems instead of actually trying to correct them. Admiral Rickover, 1982 25